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OPPORTUNITIES AND CHALLENGES IN AD- 
VANCING HEALTH INFORMATION TECH- 
NOLOGY 


Tuesday, March 22, 2016 

House of Representatives, 

Subcommittee on Information Technology, joint 

WITH THE Subcommittee on Health Care, Benefits, 

AND Administrative Rules, 
Committee on Oversight and Government Reform, 

Washington, D.C. 

The subcommittees met, pursuant to call, at 2:06 p.m., in Room 
2154, Rayburn House Office Building, Hon. William Hurd [chair- 
man of the Subcommittee on Information Technology] presiding. 

Present from Subcommittee on Information Technology: Rep- 
resentatives Hurd, Walker, Blum, Connolly, and Lieu. 

Present from Subcommittee on Health Care, Benefits, and Ad- 
ministrative Rules: Representatives Walberg, Gowdy, DeSantis, 
DeSaulnier, Cartwright, and Lujan Grisham. 

Mr. Hurd. The Subcommittee on Information Technology and the 
Subcommittee on Health Care, Benefits, and Administrative Rules 
will come to order. Without objection, the chair is authorized to de- 
clare a recess at any time. 

We are expecting votes fairly soon, so I am hoping we can get 
through opening remarks, go do our vote series, and come back and 
finish the hearing. 

Good afternoon. I appreciate your being here today. You all know 
that heart disease is a leading cause of death in the United States, 
according to the CDC. More than 600,000 Americans die from heart 
disease each year. 

The American Medical Association recommends walking as the 
simplest positive change you can make to improve your heart 
health. Walking 30 minutes day, or around 10,000 steps, lowers 
blood pressure, improves movement and mobility, and increases en- 
ergy. Simply increasing the number of steps you take per day can 
significantly reduce your risk of coronary heart disease and stroke. 

Many of you could glance right now at your smart phones, 
wearables, or other devices and report your number of steps and 
calories burned for the same period of time. For most of us, I will 
bet that number is probably higher than before we had the app or 
device and we were tracking our steps. 

It would not be an extreme exaggeration to say that the pro- 
liferation of wearable devices and smart phone apps that track 
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steps and the accompanying increases in the number of steps some 
people are taking on a daily basis has saved lives. 

This is just one example of the benefits technology has brought 
to health and health care, and we have barely scratched the sur- 
face. We are on the cusp of being able to use technology to truly 
revolutionize health care and health care delivery. 

Leveraging the power of the cloud will enable us to move more 
health care tasks online, including consultations and data storage 
and retrieval. 

Sensors will make it easier for people to take care of themselves 
before they get sick. Constituents in rural parts of Texas 23rd, my 
district, will be able to speak directly with their primary care pro- 
viders instead of commuting hours each way. 

As more devices are connected and more data is generated, medi- 
cine will become customized and personalized. Preventative medi- 
cine and healthy living practices will increase, costs will decline, 
and the prevalence of chronic diseases will decrease substantially. 

But this will only happen if researchers, hospitals, entre- 
preneurs, regulators, health care professionals, patient advocates, 
and lawmakers come together to update antiquated laws and re- 
form outdated institutions. 

Right now, old and unclear privacy laws hinder interoperability 
between health IT systems and devices. Right now, the sheer num- 
ber of Federal agencies, and often conflicting rules one must navi- 
gate to invest in the space, chills investment and entrepreneurship. 
And right now, a fragmented and bureaucratic system places the 
patient at the fringe of the process, rather than at the center. 

In today’s hearing, I hope to hear specifically what laws or regu- 
lations need to be changed or updated, and how they should be 
changed or updated or abandoned. 

Health IT is an exciting, innovative field, but to get this right, 
we must collaborate. We must destroy silos. I am committed to 
doing so. I know my friend and ranking member, Ms. Kelly, and 
Ted Lieu are as well. 

And I want to thank the witnesses for being here today, and I 
look forward to their testimony. 

Now I would like to recognize Mr. Cartwright for his opening 
statement. 

Mr. Cartwright. Thank you. Chairman Hurd. I would like to 
thank you both for calling this hearing so we can hear about how 
the Federal Government and private industry are working to- 
gether, and for your interest and efforts at creating the next gen- 
eration of health information technology. 

I represent largely a rural district in northeastern Pennsylvania, 
and I know quite well how health IT can bring affordable medical 
care to those who might not otherwise be able to receive it. 

In fact, that is why I cosponsored the Medicare Telehealth Parity 
Act of 2015, the 21st Century Cures Act, and also the TELE-MED 
Act. Bills like these help medical professionals provide patients 
with the best health care available anywhere and at any time. 

But even with the undeniable benefits technology brings, patient 
safety must remain our foremost consideration. Technology brings 
opportunity, but it can also bring unforeseen challenges, and I hope 
we can talk about that a little today. 
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As a career courtroom attorney, I have seen too many medical 
malpractice lawsuits where carelessness caused injuries and death, 
and where doctors have made grave and avoidable mistakes. Too 
often these mistakes were due to failures in communication that 
left physicians and nurses without all of the patient’s information 
that they needed to complete proper assessment and treatment. 

We worry that different computer system standards and methods 
of tracking medical history often mean doctors, nurses, lab techni- 
cians, and others involved in the treatment process cannot get a 
complete understanding of the illness in front of them and the 
treatment that is needed. 

That is why it is so important that technologies like electronic 
health records, which contain the complete medical and treatment 
history of a patient quickly and efficiently give providers insight 
and a comprehensive view into what is going on and all the facts 
of the case. Standardized, industry-accepted technologies can make 
that happen, in my view. 

In the field of health IT, private industry has a critical role in 
the process doing what it does best: drive innovation and keep 
America at the leading edge in medical technology. 

The Federal Government also has a role to play, making sure 
these new technologies meet health care needs without compro- 
mising patient safety. 

I am looking forward to today’s hearing, to the testimony of all 
of you. I am glad that industry and government are working to- 
gether to bring about the kinds of technological advances that will 
improve health care in this country, make it safer, and make it 
more available to people in all corners and all pockets of this Na- 
tion. 

I thank you again. Chairman Hurd, and I yield back. 

Mr. Hurd. Thank you. 

I am going to hold the record open for 5 legislative days for any 
members who would like to submit a written statement. 

Ranking Member Lieu is here, and if he is ready, we will have 
him give his opening remarks. 

Mr. Lieu from California is recognized for 5 minutes. 

Mr. Lieu. Thank you, Mr. Chairman. 

Thank you to the witnesses who will be presenting today. 

Today, we are here to learn more about how to make the primary 
health technology laws work smarter and better. Laws and regula- 
tions should be there to protect the public, but done incorrectly, 
they can hinder innovation, and the same holds true in the health 
IT space. 

The Health Insurance Portability and Accountability Act, 
HIPAA, contains provisions to create universal electronic medical 
records and protect patient privacy. The Health Information Tech- 
nology for Economic and Clinical Health, HITECH, contains provi- 
sions to protect consumer privacy and give notice in case of data 
breach. The Affordable Care Act also contains provisions to im- 
prove the quality and efficiency of patient care with EHRs. 

However, these laws and regulations were enacted before key 
technological advances that we now take for granted. HIPAA was 
passed in 1996 before broad adoption of the mobile revolution. 
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HITECH was passed in 2009, before much of cloud computing ex- 
isted. 

Some might suggest that rolling back regulations is the answer. 
While I agree that government regulation is not as nimble as tech- 
nology, we still need some combination of regulations and enforce- 
able guidance to protect the public. 

For instance, last month, the IT system at Hollywood Pres- 
byterian Hospital in Southern California was held hostage by 
ransomware denying patients and providers access to their medical 
records. The HITECH law has cybersecurity requirements that re- 
quire notifications for data breaches, but the law says nothing 
about notification for data that was frozen or held hostage where 
it is stored. 

I note that today the press reports that two more hospitals in 
Southern California were hit with malware attacks. 

Technology is moving very quickly. Telemedicine and text mes- 
saging and mobile smart phone exposure requires that HHS and 
FTC keep up with technology changes, update guidance reliably, 
and keep rules and regulations flexible to encourage innovation. 

Regulation done wrong or too little regulation makes it difficult 
to protect the public and ensure that data flows freely. Regulation 
done right spurs innovation and improves quality of care and pro- 
tects the public. 

I look forward to hearing from the witnesses today about what 
we can do to encourage innovation and cooperation, and continue 
to bring government health care into a more modern era of service. 

With that, I yield back. 

Mr. Hurd. Thank you, Mr. Lieu. 

If Chairman Jordan joins us and is interested in giving opening 
remarks, we will let him do that as he arrives. 

Again, I would like to thank the witnesses. I would like to recog- 
nize you all now. I am pleased to welcome Dr. Karen DeSalvo, na- 
tional coordinator for health information technology at the U.S. De- 
partment of Health and Human Services. Thank you for being 
here. Ms. Jessica Rich, director of the Bureau of Consumer Protec- 
tion at the U.S. at the Federal Trade Commission; Mr. Matthew 
Quinn, Federal managing director at Intel Healthcare and Life 
Sciences; Mr. Neil DeCrescenzo, member of the executive com- 
mittee at the Healthcare Leadership Council; and Mr. Mark Sav- 
age, director of health IT policy and programs at the National Part- 
nership for Women and Families. 

Welcome to you all. Pursuant to committee rules, all witnesses 
will be sworn in before you testify. 

Please rise and raise your right hands. 

Do you solemnly swear or affirm that the testimony you are 
about to give will be the truth, the whole truth, and nothing but 
the truth? 

Thank you. Please be seated. 

Let the record reflect that the witnesses answered in the affirma- 
tive. 

In order to allow time for discussion, please limit your testimony 
to 5 minutes. Your entire written statement will be part of the 
record. 
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We are going to go through as many opening remarks as we can 
before we get called to votes. If the hells go off while you are in 
your remarks, go ahead and continue. We will finish after your re- 
marks. 

Now I would like to recognize Ms. DeSalvo for your opening re- 
marks. 


WITNESS STATEMENTS 

STATEMENT OF KAREN DeSALVO, M.D. 

Dr. DeSalvo. Thank you, Chairman Hurd, and Ranking Mem- 
bers Lieu and Cartwright, and distinguished members of the sub- 
committees. Thank you all for the opportunity to appear here 
today. 

I am Dr. Karen DeSalvo, and I have the honor of serving as the 
national coordinator for health information technology at the U.S. 
Department of Health and Human Services for the past 2 years. 
I’m proud to be here today representing the remarkable team at 
the Office of National Coordinator and share with you the current 
State of health information technology in our Nation and how we 
are working with others to see that these systems realize their full 
potential. 

The Office of the National Coordinator for Health Information 
Technology has a strong, bipartisan history. It was established in 
2004 by executive order and charged with the mission of giving 
every American access to their electronic health information. In 
2009, it was statutorily established by the Health Information 
Technology for Economic and Clinical Health Act, or HITECH, 
which provided the resources and infrastructure needed to foster 
the rapid nationwide adoption and use of health IT. 

In the 7 years since HITECH was enacted, we have seen dra- 
matic progress. Today, nearly all hospitals and more than three- 
quarters of physicians report using a certified electronic health 
record. This tripling in rates of adoption puts us as a Nation well 
ahead of our peer countries, giving us a significant competitive ad- 
vantage in health care innovation and scientific advancement. And 
it is working in so many communities across this country. 

But I also note that we haven’t realized the full potential of 
health IT for every person in this country. 

And this is not just an abstract policy idea to me. It is personal. 
It is why I came to ONC 2 years ago, because I knew as a doctor 
the promise of health IT, of having information available for me 
when I was on call in the evening not at the hospital, such a leap 
from the days in the early 1990s when I was a medical school stu- 
dent at Charity Hospital and had to physically go up to a lab and 
pull a lab slip with handwritten results from a wooden box, so that 
I would understand more about my patients and how to care for 
them. 

Today, that is all available electronically to me and other doctors, 
and not just to us but to our patients, to really see that they can 
be empowered and have the information they need to self-care. It 
is a rapid and remarkable transformation in a very short period of 
time. But the pace has come with challenges. 
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Like others, I have heen frustrated hy the lack of interoper- 
ability, by the usability of the systems, and by how hard it can be 
to select the right system to buy. I hear about these challenges 
from my colleagues whether at listening sessions but also from con- 
sumers and other stakeholders. 

We all want to move ahead with technology, but we want it to 
work better. That is what I came to Washington to do. 

Since I’ve been the national coordinator, we have been focused on 
fixing those challenges in an urgent fashion to meet the expecta- 
tions of the people that I serve, the American people. ONC does 
this in a variety of ways. 

For example, we can leverage our electronic health record certifi- 
cation program. We also serve as a coordinator across the Federal 
Government to see that agencies have shared policy and technology 
approaches and will send clear signals to the private sector. 

We have also worked with the private sector on setting a clear 
path ahead for our nationwide interoperability. This roadmap that 
we produced last year lays out who should do what by when to 
achieve interoperability in the near term to see that electronic 
health information is available when and where it matters to con- 
sumers and clinicians. 

ONC and others have been meeting our deliverables from this 
plan and are advancing drivers of interoperability like payment re- 
form, publishing clear standards, working with States and others 
on harmonizing privacy and security expectations. The plan has 
been publicly endorsed by our Federal partners, by the private sec- 
tor, and we have been so pleased with everyone’s willingness to 
step up and lead where appropriate, to see that we can innovate 
and accelerate interoperability. Indeed, working with the private 
sector is how ONC operates. 

As another example, we recently convened stakeholders to ask 
them to make a series of commitments to ensure that electronic 
health information works better for patients and providers. It is a 
really tremendous opportunity for the private sector to lead. 

So last month, we were able to announce that companies that 
provide electronic health records for 90 percent of hospitals in this 
country, and health care systems with facilities in 46 States, in- 
cluding the States for all the members of these two subcommittees, 
and over a dozen professional associations and stakeholder groups 
like the AMA and the American Hospital Association, all have 
agreed to implement three commitments that will help make sure 
health information flows. 

The commitments are that consumers will have access to their 
electronic health information, that entities will not engage in 
health information-blocking, and that we will move to federally rec- 
ognized national standards so that all these different systems will 
speak the same language. 

ONC and our partners in the Federal space and the private sec- 
tor are working together each and every day to see that we can 
move this future vision to an immediate reality. And Congress has 
been one of the great partners in health IT, and I look forward to 
continuing to work with you all to realize the full potential of 
health IT for this country. 
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Thank you for having me here today, and I look forward to your 
questions. 

[Prepared statement of Dr. DeSalvo follows:] 
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Chairmen Hurd and Jordan, Ranking Members Kelly and Cartwright, and distinguished 
Subcommittee members, thank you for the opportunity to appear today. I am Dr. Karen 
DeSalvo, the National Coordinator for Health Information Technology in the US Department of 
Health and Human Services. I am proud to be here today representing the remarkable team at 
the Office of the National Coordinator for Health Information Technology (ONC) and to share 
with you the current state of health information technology (health IT) in our nation, and how we 
have been working collaboratively with a diverse array of stakeholders to help these systems 
realize their full potential now and in the future to support clinicians and consumers for better 
care and healthier people and communities. 

ONC was established by Executive Order in 2004 and charged with the mission of giving 
every American access to their electronic health information when and where they need it most. 
In 2009, ONC was statutorily established by the Health Information Technology for Economic 
and Clinical Health Act (HITECH), enacted as part of the American Recovery and 
Reinvestment Act (ARRA). HITECH provided the resources and infrastructure needed to 
stimulate the rapid, nationwide adoption and use of health IT, especially electronic health 
records (EHRs). In the seven years since the HITECH Act was enacted, we have seen dramatic 
advancement in adoption and use of health IT. By 2014, nearly all hospitals (97 percent) 
reported possessing certified EHR technology'. Roughly three-quarters of physicians report 
possessing a certified EHR^. The combined efforts of HITECH initiatives such the Regional 
Extension Centers, the ONC Health IT Certification Program, use of standard terminologies, and 
tlie CMS Medicare and Medicaid EHR Incentives Programs have brought us past a tipping point 
in the use of health IT. Today, we are firmly on the path to an interoperable, digital health care 
system; but, we acknowledge that there is still much work to do to realize the digital dividend. 

Prior to becoming the National Coordinator in January 2014, 1 worked in a variety of 
settings that provided me with keen insight into and experience working with health IT systems. 
My previous positions include serving as the Health Commissioner for the City of New Orleans 
and the Senior Health Policy Advisor to the Mayor of New Orleans, and a professor of medicine 

^ Charles, D., Gabriel, M., Searcy T. (April 2015) Adoption of Electronic Health Record Systems among U.S. Non- 
Federal Acute Care Hospitals: 2008-2014. ONC Data Brief, no.23. Office of the National Coordinator for Health 
Information Technology: Washington DC. 

~ Heisey-Grove, D., Patel, V. (September 2015) Any, Certified, or Basic: Quantifying Physician EHR Adoption. 
ONC Data Brief, no. 28. Office of the National Coordinator for Health Information Technology: Washington DC. 
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and vice dean for community affairs at Tuiane University School of Medicine. In addition, I 
have practiced internal medicine for close to a quarter century. In all of these positions, I have 
established, purchased, utilized, implemented, and studied health FT systems. I not only 
understand the importance of health IT to improving the overall health care in this nation, but I 
also understand firsthand the numerous complications and frustrations that we have faced, and 
continue to face along the way. I came to ONC to build on the incredible progress we have made 
since 2009, and to move us forward into a new and exciting era of health IT. Thus far, I have 
focused my energy and attention on what I believe is a fundamental piece of the puzzle to 
moving us forward, and that is a ubiquitous, safe, and secure interoperable health IT 
infrastructure. 

As a result, since I became the National Coordinator, ONC has been working 
systematically and intensely to harness the health care industry’s energy and consumer demands 
for interoperability to drive improvement in health. We respect and feel the strong sense of 
urgency and have acted on it. 

We delivered a clear strategy to get to an interoperable health system in “Connecting 
Health and Care for the Nation: A Shared Nationwide Interoperability Roadmap version 1 .0”.^ 
The Roadmap focuses primarily on impactful, near-term actions we all can take by the end of 
2017 to improve interoperability. These actions are as follows: first, “Drivers,” which are 
mechanisms that can propel a supportive payment and regulatory environment that relies on and 
deepens interoperability; second, “Policy and Technical Components,” which are essential for 
stakeholders to implement in order to enable interoperability, such as shared standards and 
expectations around privacy and security; and third, “Outcomes,” which serve as metrics by 
which stakeholders will measure our collective progress on implementing the Roadmap. Since 
we released the Roadmap, we have been working systematically to meet our expected 
deliverables and milestones. For example, in September 2015, we undertook a project to 
develop a State Interoperability Roadmap with the National Governors Association. This on- 
going work will help to guide states in addressing disparate state privacy laws that may impede 
nationwide interoperability. We also recently launched the Interoperability Proving Ground, a 
website that provides stakeholders with an open, community platform to share, learn, and be 


’ httDs:/'/ww.heaithit.gov.-'sites/default/files.'hie-interotierabilitv/natioiiwide-interoDerabilitv-roadmaD-fmal-version- 
l.O.pdf 
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inspired by interoperability projects taking place across the nation. To help support and advance 
the development of market-ready, user-friendly approaches, in March we launched a $625,000 
strategic investment to connect and accelerate the industry’s use of Fast Healthcare 
Interonerahilitv Resources (FHIR)'' standards-based application programming interfaces (APIs)^ 
for consumers and providers, which includes two challenge contests to spur private sector 
innovation. 

Additionally, ONC is currently taking advantage of a changing payment landscape that is 
improving the business case for interoperable health IT. A key component of the 
Administration’s Delivery System Reform initiative is expanding the use of alternative payment 
models that reward value over volume and support better care coordination and population 
health. A strong health IT infrastructure is a necessary feature to achieve those goals. ONC 
actions are designed to drive towards better distribution of information and leveraging 
technology to support Delivery System Reform. At the same time, the Department’s work to 
advance payment reform directly supports the business case needed to drive towards an 
interoperable, digitized care system. 

Further, recognizing the essential role of the private sector in moving interoperability 
forward, Secretary Burwell recently announced an important step in furthering several shared 
priorities. On February 29, the Secretary highlighted that companies that provide 90 percent of 
electronic health records used by hospitals nationwide, healthcare systems with facilities in 46 
states, and more than a dozen professional associations and stakeholder groups ^ have agreed to 
implement three core commitments around consumer access, information blocking, and 
standards. The organizations that made these commitments represent technology developers, 
hospitals, integrated healthcare organizations, medical groups and physician offices, academic 
facilities, long-term and behavioral healthcare settings, professional and advocacy organizations, 
and patients throughout the country. 

We understand the importance of a broad, all-of-govemment strategic approach to 
achieving interoperability and a better health care system. In October 20 1 5 we issued the Federal 
Health IT Strategic Plan 2015-2020. This Plan, developed in partnership with over 35 Federal 

FHIR is a standard being deveioped by a standards development organization, HL7, to support the exchange 
healthcare information electronically. 

■*’ These are technology tools that underpin many consumer applications (apps) and will enable the development of 
new functionalities to build bridges across systems and provide increased data access. 

^ wu'w, healthit.gov/commitment 
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entities, demonstrates the extensive interest across the Federal Government in digitizing the 
health experience for all individuals and facilitating progress towards a learning health system 
that can improve health and care. The Plan has been designed to support important changes 
already occurring in the health landscape, such as the Precision Medicine Initiative and the 
Department of Defense's Militaiy Health System's acquisition of a new health IT system, as well 
as longer-range changes, such as FDA's Sentinel program. The Plan’s long-term vision of a 
learning health system relies on the use of technology and health infonnation from a multitude of 
sources for a multitude of purposes, and working with our Federal partners, with the Congress, 
and other stakeholders, our strategies will evolve to ensure we can meet this vision for the 
Nation. 

ONC is committed to moving forward by promoting the use of health IT to encourage 
information exchange, not only across the Department and Government-wide, but also with 
outside stakeholders, including the Congress. We realize everyone has a role to play in moving 
health IT systems forward and look forward to the challenge ahead of us. Thank you again for 
inviting me today. 
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Mr. Hurd. Thank you, Dr. DeSalvo. 

Now, Ms. Rich, you are recognized for 5 minutes. 

STATEMENT OF JESSICA RICH 

Ms. Rich. Chairman Hurd, Ranking Members Lieu and Cart- 
wright, and members of the subcommittees, I am Jessica Rich, di- 
rector of the Bureau of Consumer Protection at the Federal Trade 
Commission. I appreciate this opportunity to present the commis- 
sion’s testimony. 

Consumers are increasingly taking an active role in managing 
their health data, and there has been an explosion of new products 
and services to help them. These range from wearable fitness de- 
vices like Fitbit or Jawbone, to dieting apps like My Fitness Pal 
and Calorie Counter, and to Web sites like WebMD where con- 
sumers can get health advice and information. 

These products and services offer enormous benefits to con- 
sumers, but they raise privacy and security concerns, too. Who has 
access to all of this data? And is it being stored securely? 

Much of this activity now happens outside of the doctor’s office 
and other traditional health care contexts. As a result, it is not pro- 
tected under HIPAA, which only applies to health data held or gen- 
erated by covered entities, such as health care providers and health 
plans. In most instances, however, this activity is covered by the 
Federal Trade Commission Act, which prohibits unfair or deceptive 
practices across the marketplace, including in the area of health 
privacy. 

As the primary Federal agency charged with protecting consumer 
privacy, the FTC has made it a priority to protect consumer-sen- 
sitive health information. Our efforts include civil law enforcement, 
policy initiatives, and consumer and business education. 

Three recent FTC cases illustrate the challenges we face in pro- 
tecting consumer health data and how the FTC is addressing them. 

PaymentsMD is a medical billing company that offered an online 
portal where consumers could pay their bills. The FTC charged 
that the company misled thousands of consumers who signed up by 
failing to tell them that it would also seek their highly detailed 
medical data from pharmacies, medical labs, and insurance compa- 
nies. 

Henry Schein provided office equipment software for dental prac- 
tices. We charged this company with misrepresenting to clients 
that its software provided industry-standard encryption of sensitive 
patient information as required by HIPAA. In fact, we alleged the 
software used a weaker method of data masking that didn’t meet 
HIPAA standards. 

A third example is our settlement with GMR, a medical tran- 
scription service. We charged that GMR assured its clients that its 
services were secure but outsourced them to a third-party service 
provider without adequately checking its security measures. As a 
result, consumers found doctors’ notes of their physical examina- 
tions freely available on the Internet. 

Besides enforcement, the commission engages in policy initiatives 
to encourage stronger protection for health information. Last year, 
we hosted a public workshop on consumer health data to examine 
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the products and services consumers are using to generate and con- 
trol their data and how this data is protected. 

We also released a staff report on the Internet of Things, which, 
among other topics, examined the privacy and security issues 
raised by connected medical devices and health and fitness prod- 
ucts. Of greatest concern, panelists discussed the unique risks if 
health devices like pacemakers and insulin pumps are not secure 
and are vulnerable to hackers. 

Finally, the commission promotes stronger data protections 
through consumer education and business guidance. For example, 
our new IdentityTheft.gov Web site provides customized advice to 
consumers who have been victims of medical identity theft. 

And last year, the FTC launched its Start with Security cam- 
paign to educate small businesses around the country about how 
to develop an effective data security program. 

In addition, working with HHS and with FDA, the FTC is cur- 
rently developing business guidance for health app developers to 
help them understand which legal requirements apply to them. 

The FTC shares the subcommittees’ concerns about the need to 
protect the privacy and security of consumer health data. Although 
we now use a variety of tools to protect consumers in this area, ad- 
ditional tools would enhance our ability to do so. 

To this end, the commission reiterates its longstanding bipar- 
tisan call for Federal data security and breach legislation that 
would allow us to seek civil penalties to deter unlawful conduct and 
give us jurisdiction over nonprofit entities. 

In closing, the FTC remains committed to protecting consumer 
health data and looks forward to our continued work with Congress 
on this critical issue. Thanks again for the opportunity to provide 
the commission’s views today. 

[Prepared statement of Ms. Rich follows:] 
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I. INTRODUCTION 

Chairmen Hurd and Jordan, Ranking Members Kelly and Cartwright, and members of the 
Subcommittees, I am Jessica Rich, Director of the Bureau of Consumer Protection at the Federal 
Trade Commission (“FTC” or “Commission”). ' 1 appreciate the oppormnity to present the 
Commission’s testimony on Opportunities and Challenges in Advancing Health Information 
Technology. 

Consumers are increasingly taking a more active role in managing their healtli data. It 
seems like every day a company announces a new health-related app, device, or service. There 
are apps that allow consumers to track their diet and exercise habits, devices that help consumers 
track their glucose levels, and websites where patients with the same condition share 
information. In addition, consumers are downloading their medical information into personal 
health records and using this information to make decisions about their health. 

Much of this activity now takes place outside of doctors’ ofEces and other traditional 
medical contexts, and the tremendous growth in this area is not slowing down. Many of these 
products and services offer consumers substantial benefits in the form of increased consumer 
engagement in their health and fitness, reduced healthcare costs, and improved outcomes. But 
these products and services also raise privacy and security concerns. Consumers may be 
concerned about the unauthorized disclosure of their health data, which they often regard as 
highly sensitive and private. In addition, data breaches involving health information can cause 
serious harms to consumers, including fraud and medical identify theft. Finally, if consumer 
health data is used for unanticipated, harmful purposes, consumers could lose confidence in the 
health IT sector. Many of the entities creating these new consumer facing products and services 
are not covered by the Health Insurance Portability and Accountability Act, or HIPAA, which 
only provides protections for health information held or generated by certain “covered entities” - 
namely health care providers, health plans, and health care clearinghouses, and their business 
associates. The entities creating these new products are, however, within the FTC’s jurisdiction 
in most instances. As the nation’s foremost consumer protection agency, the FTC is committed 
to protecting health information collected by these entities. The Commission has engaged in 
substantial efforts over the years to promote data security and privacy in this area through civil 
law enforcement, policy initiatives, and business and consumer education. This testimony 
provides an overview of the Commission’s recent efforts and provides recommendations for next 
steps. 


' This written statement presents the views of the Federal Trade Commission. My oral statements and 
responses to questions are my own and do not necessarily reflect the views of the Commission or of any 
Commissioner. 
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II. THE COMMISSION’S PRIV ACY AND DATA SECURITY WORK IN THE 
HEALTH AREA 

A. Law Enforcement 

The FTC enforces several statutes and rules that impose obligations upon businesses to 
protect consumer data.^ The Commission’s primary authority is Section 5 of the FTC Act, 
which prohibits unfair or deceptive acts or practices in or affecting commerce.^ If a company 
makes materially misleading statements or omissions about a matter, including privacy or data 
security, and such statements or omissions are likely to mislead reasonable consumers, they can 
be deceptive in violation of Section 5.“ Further, if a company’s practices cause or are likely to 
cause substantial injury to consumers that is neither reasonably avoidable by consumers nor 
outweighed by countervailing benefits to consumers or to competition, those practices can be 
unfair and violate Section 5.’ 

The FTC’s Section 5 authority extends to both HIPAA and non-HIPAA covered entities,* 
though generally this authority does not reach nonprofit entities or practices that are in the 
business of insurance to the extent that such business is regulated by state law,^ The FTC Act is 
currently the primary federal statute applicable to the privacy and security practices of businesses 
that collect individually identifiable health information where those entities are not covered by 


= 15 U.S.C. § 45(a) (Section 5 of the FTC Act); 15 U.S.C. §§ 6801-6809 (GLBA); 15 U.S.C. § 1681 
(FCRA); 15 U.S.C. §§ 6501-6506 (COPPA) and 16 C.F.R. Part 312 (COPPA Rule). 

■’ 15 U.S.C. § 45(a). 

“ See Federal Trade Commission Policy Statement on Deception, appended to CUffdale Assocs., Inc., 103 
F.T.C. 110, 174(1984). 

* See Federal Trade Commission Policy Statement on Unfairness, appended to Int 7 Harvester Co., 104 
F.T.C. 949, 1070 (1984) (“FTC Unfairness Statement”); 15 U.S.C. § 45(n). In addition to its FTC Act 
enforcement, Congress in 2009 directed the FTC to implement a breach notification rule for certain web- 
based businesses not covered by HIPAA that provide or interact with personal health records. 16 C.F.R. 
Part 318. The FTC’s Rule requires these businesses to notify individuals, the FTC, and in some cases, the 
media when there is a breach of unsecured, electronic health information. In addition, the Rule requires 
service providers to these entities to notify them in case of a breach. 

® The Department of Health and Human Services (HHS) and the FTC have worked closely in areas of 
concurrent jurisdiction, as they have common interests in ensuring the privacy and security of health 
information for individuals, whether that health infonnation is within or outside the scope of HIPAA. For 
example, FTC staff collaborated with HHS’s Office for Civil Rights to bring a set of cases involving 
faulty data security practices that implicated both HIPAA and the FTC Act. See Rite Aid Corporation, 
No. C-4308 (F.T.C. Nov. 12, 2010) (decision and order), available at: 

https://www.flc.gOv/cnforcement/cases-proceedines/072-312l./rite-aid-corDoration-matter: see also CVS 
Caremark Corporation, No. C4259 (F.T.C. June 18, 2009) (decision and order), available at: 
https://www.ftc.gov/enforcement/cases-proceedings/072-31 19/cvs-caremark-corporation-matter. 

^ 15 U.S.C. §§ 44 & 45(a). The FTC does not have jurisdiction under the FTC Act over most non-profit 
organizations, although it does have jurisdiction over sham charities or other non-profits that in actuality 
operate for profit. The FTC’s Section 5 jurisdiction also does not extend to banks, savings and loan 
institutions, Federal credit unions, common carries, air carriers, or packers and stockyard operators. 
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HIPAA. 

One recent example of FTC enforcement involving health information is the 
Commission’s settlement with medical billing company PaymentsMD, LLC and its former CEO, 
Michael C. Hughes.® The complaint alleged that the company deceived thousands of consumers 
who signed up for an online billing portal by failing to adequately inform them that the company 
would seek highly detailed medical information about them from pharmacies, medical labs, and 
insurance companies. Specifically, the company allegedly used the sign-up process for its 
“Patient Portal” - where consumers could view their billing history - to deceptively seek 
consumers’ consent to collect detailed medical information from other entities for use in a 
separate Patient Health Report service.® The Commission’s order prohibits PaymentsMD and 
Hughes from making fature privacy misrepresentations. It also requires respondents to destroy 
any information collected as a result of its allegedly deceptive sign-up process, and obtain 
consumers’ affirmative express consent before collecting health information about a consumer 
from a third party. 

The FTC has also used its Section 5 authority to bring enforcement actions against 
companies that fail to maintain reasonable and appropriate data security practices regarding 
consumer data, including health data. Since 2001, the Commission has obtained settlements in 
approximately 60 cases challenging such failures. In investigating these cases, the FTC 
determines whether a company’s data security measures are reasonable and appropriate in light 
of the sensitivity and volume of information it holds, the size and complexity of its data 
operations, and the cost of available tools to improve security and reduce vulnerabilities. The 
Commission orders obtained in these cases have halted harmful data security practices; required 
companies to provide strong protections for consumer data; and raised awareness about the risks 
to data, the need for reasonable and appropriate security, and the types of security failures that 
raise concerns.” 

An example of FTC data security enforcement in the health area is the FTC’s settlement 
with GMR Transcription Services, Inc., and its owners for violations of Section 5. According 
to the complaint, GMR provides audio file transcription services for their clients, which include 
health care providers, and relies on service providers and independent typists to perform this 
work. The complaint charged that GMR exchanged audio files and transcripts with customers 
and typists by loading them on a file server. As a result of GMR’s alleged failure to implement 
reasonable and appropriate security measures and to ensure that its service providers also 
implemented reasonable and appropriate security, at least 15.000 files containing sensitive 


* PaymentsMD, LLC, No. C-4505 (F.T.C. Jan. 27, 2015) (decision and order), available at: 
https://www.ftc.gov./enforcement/cases-Droceedines/l 32-3088/pa vmentsmd-llc-matter . 

•> 14 . 

'Ud. 

” See Commission Statement Marking the FTC’s 50th Data Security Settlement, Jan. 31, 2014, available 
at http://www.ftc.gov/svstem/files/documents/cases/140131tgnrstatement.pdf . 

” GMR Transcription Servs., Inc., No. C^82 (F.T.C. Aug. 14, 2014) (decision and order), available at 
https;//www.ftc.gov/enforcement/cases-proceedings/122-3095/ginr-transcription-services-inc-matter. 
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personal information including consumers’ names, birthdates, and medical histories - were 
available to anyone on the Internet. The Commission’s order resolving the case prohibits GMR 
from making misrepresentations about privacy or security, and requires the company to 
implement a comprehensive information security program and undergo independent audits for 20 
years. 


More recently, the FTC settled an action against Henry Schein Practice Solutions, Inc. 
According to the complaint, Henry Schein, a provider of office management software for dental 
practices, misrepresented that its software provided industry-standard encryption of sensitive 
patient information. The Commission’s proposed order requires Henry Schein to pay $250,000 
as an equitable remedy. The proposed order also prohibits Henry Schein from making 
misrepresentations about security and requires the company to notify all of its customers who 
purchased the software during the period when it made the allegedly misleading statements.'"' 

B. Policy Initiatives 

The Commission also undertakes policy initiatives to promote privacy and data security, 
including by hosting workshops on emerging business practices and technologies affecting 
consumer data, and coordinating, where appropriate, with other agencies. This testimony 
describes three examples of such initiatives relating to the privacy and security of health 
information. 

First, on May 7, 2014, the Commission hosted a seminar on Consumer Generated and 
Controlled Health Data to examine the greater role consumers are taking in managing and 
generating their own health data, including through apps, connected health and fitness devices, 
and websites that allow consumers to share information with others who have the same health 
conditions.'* During the event, FTC staff presented a snapshot showing the data-sharing 
practices of twelve health and fitness apps, including two apps associated with wearable devices. 
The snapshot revealed that the apps collect and transmit information to third parties, including 
device information, consumer-specific identifiers, unique device IDs, unique third-party IDs, and 
consumer information such as exercise routines, dietary habits, and symptom searches. 

The seminar also brought together a diverse group of stakeholders to discuss issues such 
as the benefits arising from the movement of health data outside the traditional medical provider 
context, the types of products and services consumers use to generate and control their healtli 
data, consumers’ expectations regarding privacy and security protections, and the actions some 
companies take to protect consumers’ privacy and security. FTC staff followed up with two blog 


Henry Schein Practice Solutions, /«c.,No. 1423161 (F.T.C. Jan. 5, 2016) (complaint and proposed 
consent order), available at httPs:/.''ww w.ftc.gov/enforcement^cases-Droceedings/142-316L'henrv-5chein- 
practice-solutions-inc-inatter . 

'*Id. 

” See http://www.ftc. gov/new's-events/events-calendar/2014/05/sDring-Drivacv-series-consnmer- 
generated-controlled-health-data . 
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posts providing additional guidance for businesses innovating in this area,'* 

Second, at the beginning of 20 1 5, the FTC released a staff report about the Internet of 
Things (“loT”). '' Among other areas, the report examined the growth of increasingly connected 
medical devices and health and fitness products, ranging from casual wearable fitness devices to 
connected insulin pumps. The report recommends, among other things, that companies 
developing loT products secure personally identifiable information and device functionality by, 
for example, conducting risk assessments, hiring and training appropriate personnel, monitoring 
access controls, and utilizing technologies such as encryption. 

Third, FTC staff have worked with the Department of Health and Human Services’ 

(HHS) Office of the National Coordinator for Health Information Technology (ONC) on several 
initiatives. For example, FTC staff provided comments on the Federal Health IT Strategic Plan, 
a coordinated effort among more than thirty-five federal agencies to advance the collection, 
sharing, and use of electronic health information in a manner that protects privacy and security in 
order to improve health care, individual and community health, and research.'* FTC staff also 
participated as ex officio members in the Privacy and Security Workgroup of ONC’s Health IT 
Policy Committee which, among other things, considered the intersection of big data and 
healthcare. 


C. Consumer Education and Business Guidance 

The Commission also promotes better data security and privacy practices through 
consumer education and business guidance. On the consumer education front, the Commission 
manages a consumer information website and blog with over 300 articles and blog posts related 
to privacy and security. The website gets over 1 8 million visitors each year, and the blog has 


Using Consumer Health Data? (Apr. 2015,), availahle ai https://www.ftc.gov/news- 
events/blogs/business-blog/2015/04/'using-consumer-health-data : Using Consumer Health Data: Some 
Considerations for Companies (Apr. 2015), available at, https://www.ftc.gov/news- 
events/blogs/business-blog/2015/04/using-consuiner-health-data-some-considerations-coiirir)anies . 

‘’FTC Staff Report, Internet of Things: Privacy and Security in a Connected World (Jan. 2015), available 
at https;//www.ftc.gov/reports/federal-trade-commission-staff-report-november-201 3-workshop-entitled- 
intemet-things Commissioner Ohlhausen issued a concurring statement. See 

https:/'/www.ftc.gov/sites/default/Fdes/documents.’Dublic stalcments/remarks-commissioner-maureen- 
k.ohlhausen-ftc-intemet-things-workshop/ 13111 9iotspeech.pdf : Commissioner Wright dissented to the 
release of the report. See 

https:/Avww.ftc.gov/svstem/files.''documents/public statements/620701/1 501 27iotidwstmt.pdf . 

'* See https://ftwrv.healthit.gov/sites/default/files/9-5-federalhealthitstratDlanfinal Q.pdf . FTC staff also 
commented on ONC's Shared Nationwide Interoperability Roadmap for Health Infonnation Technology 
Systems, a plan to guide the future development of the nation’s health IT infrastructure. See 
httDs://wvw.ftc.gov'/svstem/files/documents/advocacv documents/ftc-staff-comment-office-national- 
coordinator-health-information-technology-regarding-its-drafl/l 504-roadmaphealth.pdf . 

See Health Big Data Recommendations (August 2015), available at 
wftw.healthit.gov/sites.Taca/Files/HiTPC Health Big Data Report FINAL.pdf . 

See generally https:/7ftww.consumer.ftc.gov/ . 
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over 100,000 email subscribers. In addition, as part ofIdentityTheft.gov, the FTC provides 
customized advice for victims of medical identity theft. Among other things, these materials 
help consumers determine if they have been victims of identity theft, how to correct mistakes in 
their medical records, how to protect their medical information, and how to check for other 
identity theft problems. 

The Commission directs its outreach to businesses as well. “Start with Security” is the 
Commission’s latest effort to educate businesses about information security. This initiative 
kicked off with a business guide that highlighted what businesses could leant from more than 50 
data security cases brought by the FTC in recent years."’ The FTC is now following, up with 
conferences and webinars around the country, aimed at educating small- and medium-sized 
businesses in various industries.” Our goal is to help companies reduce security risks by starting 
with smart data security practices. In addition, the BCP business blog, which has over 50,000 
email subscribers, regularly explains FTC cases and illustrates lessons learned in plain language. 
The Commission also has released articles directed towards particular non-legal audiences 
regarding data security.’’ For example, the FTC has specific tips to help mobile app developers 
build data security in from the start,’'* The FTC also has released business guidance about 
building security into connected devices.” 

Recognizing that mobile health app developers are often confused about which legal 
requirements apply to them, the FTC has undertaken a joint interagency project with HHS to 
provide guidance on this issue. In cooperation with HHS’s ONC, Office for Civil Rights, and 
Food and Dmg Administration, the FTC is developing an interactive tool that uses a series of 
high-level questions and prompts to show app developers which laws - including HIPAA, the 
Federal Food, Drug, and Cosmetic Act, the FTC Act, and the FTC’s Health Breach Notification 
Rule — apply to them. Once a developer determines which laws apply, he or she can use 
hyperlinks within the tool to access each agency’s guidance and learn how to comply with 
relevant laws. This interactive resource will reside on the FTC’s website with links from other 
agencies. In conjunction with this project, the FTC also plans to release additional business 
guidance to help mobile health app developers build privacy and security into their apps. 


” See Start with Security: A Guide for Business (June 2015), available at https://www.fte.gov/tips- 
ad\ice/busine.ss-center/guidance/start-securitv-guide-business . 

” See Start with Security - San Francisco, available at https://www.ftc. gov/news-events/events- 
calendaT/2015,/09/start-securitv-san-francisco : Start with Security - Austin, available at 
https://ww^.ftc.gov/news-events/events-calendar/2015/l 1/start-securitv-austin : Start with Security — 
Seattle, available at https://www.flc.gov/news-evenls/events-calendar/2016/02/start-securitv-seattle . 

” 5ee generally httns://www.ftc.gov/tips-adrice/business-cenler . 

See Mobile App Developers: Start with Security (Feb. 2013), available at 
http://'business.ftc.gov/documents/bus83-mobile-aDP-developeTs-start-securitv . 

” See Careful Connections: Building Security in the Internet of Things (Jan. 2015), available at 

littps:/,/w\vw.ftc.gov/tips-advice./business-cenler/guidance/careful-connections-building-securitv-intemet- 

things . 
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III. RECOMMENDATIONS FOR NEXT STEPS 

The Commission shares these Subcommittees’ concerns about the need to protect the 
privacy and security of consumers’ health data. Although the agency is using a variety of tools 
to promote better privacy and security of this data, additional tools would enhance the agency’s 
ability to protect consumers. To this end, the Commission reiterates its longstanding, bipartisan 
call for federal legislation’* that would (1) strengthen its existing data security authority and (2) 
require companies, in appropriate circumstances, to provide notification to consumers when 
there is a security breach.” Reasonable and appropriate security practices are critical to 
preventing data breaches and protecting consumers from identity theft and other harm. Where 
breaches occur, notifying consumers helps them protect themselves from any harm that is likely 
to be caused by the misuse of their data. And although most states have breach notification laws 
in place, having a strong and consistent national requirement would ensure that all consumers are 
protected while simplifying compliance by businesses. 

Legislation in both areas - data security and breach notification - should give the FTC 
the ability to seek civil penalties to help deter unlawful conduct, jurisdiction over non-profits, 
and rulemaking authority under the Administrative Procedure Act. Under current laws, the FTC 
only has the authority to seek civil penalties for data security violations with regard to children’s 
online information under the Children’s Online Privacy Protection Act or credit report 
information under the Fair Credit Reporting Act.“ To help ensure effective deterrence, we urge 
Congress to allow the FTC to seek civil penalties for all data security and breach notice 
violations in appropriate circumstances. Likewise, enabling the FTC to bring cases against non- 


’* See, e.g.. Prepared Statement of the Federal Trade Commission, “Privacy and Data Security: 

Protecting Consumers in the Modem World,” Before the Senate Committee on Commerce, Science, and 
Transportation, 1 12* Cong., June 29, 20l\, available at 

http://www.ftc.gov/sites/default/files/docuinents/public statements/prenared-statement-federal-trade- 
commission-privacv-and-data-securitv-protecting-consumers-modem/1 10629privacvtestimonvbrill.pdf : 
Prepared Statement of the Federal Trade Commission, “Data Security,” Before Subcommittee on 
Commerce, Manufacturing, and Trade of the House Committee on Energy and Commerce, 1 12* Cong., 
June 15, 201 1, available nr http://www.ftc.gov/sites/default/files/documents/public statements/prenared- 
statement-federal-trade-commission-data-securitv/1 10615datasecuritvhou5e.pdf : FTC, Security in 
Numbers, SSNs and ID Theft (Dec. 2008), available at 

lutp'.//www. ftc.gov/sites/default/Files/documents/reports/securitv-numbers-social-securitv-numbers-and- 
identitv-theft-federal-trade-commission-report/p075414ssnreport.pdf : President’s Identity Theft Task 
Force, Identity Theft Task Force Report (Sept. 2008), available at 

http://www.ftc.gov/sites/default/files/documents/reports/presidents-identitv-theft-task-force- 
report/08 1021 taskforcereport.pdf . 

’’ HIPAA has a breach notification rale, but HIPAA only applies to certain “covered entities” and their 
business associates as discussed above. Although the FTC has its own health breach notification rule, see 
supra n.5, this Rule is narrow in scope in accordance with the 2009 legislation and would not cover, for 
example, many health websites or online newsletters. Nor would it cover health apps or devices that are 
not vendors of “personal health records” or “PHR-related entities” as defined by the Rule. See 16 C.F.R. 

§ 3 1 8(2)(f) and (j). In particular, the Rule defines a “personal health record” as infomiation that “can be 
drawn from multiple sources,” such as a doctor’s office. 

” The FTC can also seek civil penalties for violations of administrative orders. 1 5 U.S.C. § 45(/). 
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profits’* would help ensure that whenever personal information is collected from consumers, 
entities that maintain such data adequately protect it. ™ 

IV. CONCLUSION 

Thank you for the opportunity to provide the Commission’s views on Opportunities and 
Challenges in Advancing Health Information Technology. The FTC remains committed to 
protecting consumer health information and we look forward to continuing to work with 
Congress on this critical issue. 


** Non-profits are generally outside the FTC’s jurisdiction under the FTC Act. 15 U.S.C. §§ 44 & 45(a). 
” A substantial number of reported breaches have involved non-profit universities and health systems. 
Sec Privacy Riglits Clearinghouse Chronology of Data Breaches (listing breaches including breaches at 
non-profits, educational institutions, and health facilities), available at httD://www.privacvrights.Qrg/data- 
breacli/new . 
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Mr. Hurd. Thank you, Ms. Rich. 

Mr. Quinn, you are recognized now for 5 minutes. 

STATEMENT OF MATTHEW QUINN 

Mr. Quinn. Good afternoon. Chairman Hurd and other esteemed 
members of the House Oversight and Government Reform Com- 
mittee. Thank you for the opportunity to testify today on hehalf of 
Intel Corporation. 

In my written testimony, I provide some tangible examples of 
how Intel is working to make good on the promise of today’s health 
technologies and to pave the way toward tomorrow’s. Today, I 
would like to frame my comments in the context of recent personal 
experiences. 

Two Fridays ago, I received a call that no one wants. My sister 
in Ohio said that dad had just taken a bad fall. He had just left 
his doctor’s office where he was in for a checkup after a recent hos- 
pitalization. 

Things had gone well, and they stopped by a favorite restaurant 
for breakfast. As my dad climbed the curb, he became lightheaded, 
fell to the ground, and tumbled back into the parking lot. As we 
soon found out, he broke his clavicle, pelvis, and deeply cut his 
elbow. 

To say that my dad is a complex patient would be an understate- 
ment. He is the poster child for needing all of his providers and 
caregivers to be on the same sheet of music and have the whole 
picture of his health and health care. 

Let’s begin by thinking of the constellation of my dad’s health 
data. Most familiar are the clinical and claims data captured at 
clinics, hospitals, and the like. Secondly, there is diagnostic data 
captured by medical devices and imaging. Adding to this is con- 
sumer-generated data. And finally, there is ’omics, vast amounts of 
information in his genome. 

Personal precision medicine in the 21st century will need to 
make sense of all of this. 

The U.S. has made great strides to ensure that each person has 
an electronic health record. Yet the goal of point-of-care and per- 
sonal access to comprehensive health information has not yet been 
achieved. 

There are three recurring barriers that often limit data-sharing. 
First, medical institutions using privacy and security policies and 
laws like HIPAA as excuses for why they can’t share; next, medical 
professionals lacking easy, affordable tools to share data, especially 
because vendors fail to use or consistently implement standards; 
and finally, payment reforms that don’t reimburse for new care 
models like telehealth. 

Back to my dad’s experience, when he arrived at the ER, the 
same hospital where he had received his most recent treatment, 
they pieced together his health history, partly from the EHR and 
partly from my parents. 

I fear that if he was brought to a different hospital, it would’ve 
been basically starting from scratch. There exists a local health in- 
formation exchange, but evidently, this hospital and my dad’s 
nephrologist don’t participate. My mom is our de facto health infor- 
mation exchange. 
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My dad would definitely enjoy the kind of secure, standards- 
based data-sharing that Intel’s own Connected Care program 
makes available for over 33,000 of its employees. As we have 
shown, it is all quite possible today, just not as widespread as it 
could be. 

We need to think about interoperability in much broader terms 
than merely exchange of electronic health record data. That will 
change as the Internet of Things takes hold and we connect smart 
devices to the Internet in ways that generate data that can be 
turned into valuable insights. 

How would this affect my dad? Well, first of all, it would allow 
him to get some sleep. Because the devices monitoring him in the 
ICU don’t talk to each other and his vitals tend to bounce around, 
there are endless, nearly always false alarms. 

What if devices even from different vendors could talk to each 
other? Innovators could create smart alarms from the new com- 
bined data streams and save countless hours of nursing time, 
countless lives, and just let my dad sleep. The data from all the 
medical devices could automatically feed the EHR, millions more 
nursing hours saved. 

But let’s think bigger. What if when my dad was discharged that 
he was outfitted with sensors or an app that constantly detected 
whether his gait was making him prone to falls? Or what if instead 
of having to drive across town to visit his doctor, he could do so 
from his home via telemedicine, and his blood and vitals could be 
automatically analyzed via his home dialysis unit? What if his 
caregivers could track his progress in getting back up on his feet 
as he rehabs? 

I think we have come up with a half-dozen ideas for new busi- 
nesses, but all of this relies on there being a solid foundation for 
the Internet of Things to blossom: security from the sensor to the 
cloud; connectivity, allowing devices to communicate their status to 
the system; data normalization to allow devices to speak the same 
language; and actionable analytics. 

So to close, how do we believe Congress can help seize the oppor- 
tunities and overcome the challenges? 

First, sustain momentum toward standards and interoperability 
for today and for tomorrow. As Intel’s Connected Care program 
demonstrates, a rigorous standard-based approach enables quicker 
and more rapid efficient deployments today. And to rapidly move 
forward toward the Internet of Things, Intel invites active Federal 
participation in industry-led initiatives such as the IIC, OCF, ICE 
alliance, and Continua. 

Second, encourage patient engagement by removing obstacles for 
patients to access and share their data. Intel invites policymakers 
to partner with industry to pursue a standardized, machine-read- 
able consent form to allow patients to easily donate their data to 
ongoing research. 

And last but not least, continue to push towards value-based 
care. We support the HHS goal to move half of care to alternative 
payment models by 2018. When incentives are aligned to value- 
based care, the demand for information-sharing goes up. Congress 
can further drive innovation by providing reimbursement for re- 
mote patient monitoring and other promising technologies. 
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Thank you, and I look forward to your questions. 
[Prepared statement of Mr. Quinn follows:] 
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Good Morning Chairman Hurd, Ranking Member Cummings and other esteemed members of the House 
Oversight and Government Reform Committee. I appreciate the opportunity to testify today on behalf of 
Intel Corporation. Thank you for your leadership in focusing on this important topic. The health of our 
nation literally hinges on our ability to seize the opportunities and overcome the challenges related to the 
promise of health information technology. 

Today I will share some tangible examples of how Intel is working with public and private organizations 
across the care and research continuum to make good on the promise of today’s health technologies and 
to pave the way toward tomorrow's. 

We’ll start with an overview of Intel’s own Connected Care Program, an initiative for value-based care, in 
which we’re leveraging our purchasing power to both directly contract with healthcare providers and also 
facilitate secure, standards-based data sharing among hundreds of care delivery organizations and 150 
different EHR vendors for over 33,000 employees across the country. 

Next, I’d like to highlight three key initiatives that illustrate the promise - and some challenges - of 
what’s ahead with Precision Medicine and “The Internet of Things” or loT: Our Collaborative Cancer 
Cloud platform, collaboration with the Michael I Fox Foundation and “You 24x7” employee wellness 
pilot. 

I will focus on two foundational principles - full data interoperability and deep patient engagement - 
throughout, as solutions or approaches that are required to achieve a high functioning health care system 
and will also focus on where government should - and as importantly, should not - play in advancing the 
ecosystem. 
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Let’s begin by thinking of the constellation of our health data over the course of a lifetime. Most familiar 
are the clinical and claims data captured at clinics, hospitals, phannacies, insurers, etc., including such 
information as diagnosis codes, prescriptions, program notes, claims, vita! signs, and test results. 
Secondly, there is diagnostic data captured by medical devices and imaging equipment. Adding to this 
now are two new data streams that are rapidly increasing in importance and opportunity: consumer- 
generated health data, captured outside the traditional health system and including such information as 
patient diaries, obser\^ations of daily living, vital sign monitors, fitness wearables, online and smartphone 
apps, social media and gaming and ‘omics — vast amounts of information contained in each person’s 
genome (and proteome, metabolome) that will increasingly be used to attack disease at its molecular 
roots. By their very nature, these diverse data (coming from what we at Intel call the ‘Tour Circle Model” 
depicted below) are collected at multiple sites, across long spans of time, and in a vast array of stiuctured 
and unstructured formats. 




ri-- 






I ’ 








. i" 
; 




»«■' f: 


Tlie reality is that personal, precision health in the 2 1 “ century will need to make sense of all of this 
information for deeper insights into population health and individual treatment. These data tell us critical 
things about one of the most important aspects of anyone’s life — our very health and well-being. To me, 
it’ s just unthinkable that we would architect a health system — a whole health economy — without 
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facilitating each person’s access to one’s own data, as well as the ability to contribute meaningM data 
about oneself back to researchers and data scientiste to gain insights into population health and wellness. 

Sharing of interoperable data must be the foundation of targeted, individuai care. 

The US has made great strides to ensure that each patient has an electronic health record. Today, 8 out of 
10 physicians are using an EHR, with 79% of primary care physicians adopting a certified EHR through 
the Meaningful Use program.* Yet the goal of point of care access to comprehensive patient records has 
not been achieved. Through research in the studies of patient experiences that Intel has done across more 
than 20 countries — we see three recurring barriers that often limit data sharing among institutions and 
patients: 

1) Medical institutions using privacy /security policies and laws like HIPAA as excuses for why 
they cannot risk sending patients their data; 

2) Medical professionals lacking easy, affordable, interoperable tools to share patient data, 
especially because app and device vendors fail to use— or correctly implement — standards; 

3) Payment reforms that reimburse for new care delivery models that will improve health and 
reduce the overall “total cost of care” as evidenced by telehealih and remote patient monitoring. 

Revisiting the four-circle model described earlier, we can see that, despite a great deal of progress, each 
type of data is still not readily available to individuals — or even their clinicians — in most cases: 

• Electronic health record data and claims: Under the Health Insurance Portability and 
Accountability Act (HIPAA), patients have a right to see and obtain a copy of their medical 
records. The American Recovery and Reinvestment Act (ARRA) extends those rights through 
modifications to HIPAA, requiring healthcare providers who utilize EHRs to give patients copies 
of their medical records in an electronic format, to another person or entity like a doctor, 
caregiver, a personal health record or mobile health application. The information is typically 
^ https://www.heaithit.gov/sites/default/ffies/briefs/oncdatabrief28 certified vs basic.pdf, September, 2015. 
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provided on paper or through a flash drive or CD, or an online clinic portal. Unfortunately, the 
regulations have two significant loopholes. First, patients can receive the information in their 
preferred electronic format only if the provider is capable of producing the copy in the requested 
format; and second, providers have 30 days (and an additional 30 if the information is stored off- 
site) to make the information available to the patient. (Certification for Meaningful Use Stage 2 
is a huge improvement by requiring the information to be made available within 4 business 
days.) Congress must have envisioned a much easier and faster method for patient access to data. 
This could be much more readily achieved with today’s technology, particularly if more of the 
information was captured as common data sets in standardized formats. 

• Consumer-generated health data: Today, there is a plethora of apps and services that collect 
health and wellness data from devices we wear, cany around with us, or use in our homes and 
workplaces. However, generally speaking, each have different logins, different and confusing 
user interfaces, and different calibration of sensors, different apps and services. Very few 
integrate with the systems used by clinicians who make up an individual’s care team. And 
consumers have a very difficult time pulling this information into one repository, controlled by 
them, that will outlast the particular device, app, employer, or insurance company with which 
they are currently associated. 

As a founding member of Continua (http:,7vvww.continuaalHaiice.org/' k Intel supports a 
developing ecosystem of certified devices that “plug and play” to give consumer-friendly 
connectivity to individuals who wish to better manage their health and wellness no matter where 
they are. If industry adopts common standards, the information from the various devices can be 
curated and exchanged with the goal of helping individuals understand their information, track 
their progress, stay on track with their care plans, and generally take more ownership of their 
health. The potential is enonnous for remote monitoring of patients with chronic diseases, with 
continuous feedback and more efficient, two-way communication between the patient and 
clinicians, but only if these data are securely shareable and interoperable. 
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• Imaging and diagnostic data: Medical imag^ make up a large percentage — estimated as high 
as one-third — of all stored data in the world. Although storage demands are high, fortunately, 
cloud-computing environments enable much more cost-effective storage of medical imaging, 
transitioning the hosting of medical images to the cloud for electronic retrieval through 
healthcare provider systems. However, providing individuals with convenient, on-the-go access 
to these often-large data files remains nascrent. Think of the advantage to you as a patient if you 
were able to log on to access all your X-rays, MRIs, ultrasounds, etc., any time you go to a new 
provider or the ER, instead of filling out request forms and waiting for the files to be shipped, or 
paying for an expensive test to be unnecessarily repeated. Since these data types are not usually 
part of the official EUR per se, the progress on patient access to their own data misses important 
classes of personal information today. 

• Genomics and other ‘omics: The data from whole human genome sequencing are so large they 
are impractical to send back and forth across institutions, and we are in the early days of having 
tool for clinicians — let alone consumers — to make use of this data. As these new data types begin 
to scale, it is important that start with commitments to — and validation of — interoperability 
and standards from the outset so we do not recreate the problems that have plagued us with EHR 
data. Also, new tools for big data analytics are necessary to scale the potential for precision 
medicine, such as the Collaborative Cancer Cloud described below. 

Because each of these data streams is important to understand each person’s whole health picture, 
providing the individual with access to parts of electronic health record (EHR) systems is necessary but 
not sufficient. As the National Institutes of Health builds out the extremely promising Precision Medicine 
Initiative, the 1 million person cohort, and our national strategy to compete globally in the economic 
opportunity that precision medicine will present, let’s make sure we build an architecture for individual 
access to personal health information from the beginning. It cannot be an afterthought, or it will never 


6 



33 


happen. We need to leam from the hard lessons of the nation’s multibiilion investments in subsidies for 
EHRs and grants for health information exchanges. We must think about interoperability in much broader 
terms than merely the doctor-to-doctor exchanges of EHRdata. We need to continue to support the 
concept of individual’s having personal health records a\'ailable to them and their care team, anytime and 
anywhere, and not tied exclusively to a particular institution or company. 

To help show what’s possible today within the current healthcare ecosystem, with currently available 
EHRs, data standards, health infonnation exchanges and , I’d like to share what Intel is doing in its own 
journey to make health care more effective and affordable. 

Intel’s Connected Care Program — an employer initiative for value-based purchasing: 

The Connected Care vision is to improve Intel employees and families’ healthcare experiences, outcomes, 
and reduce costs over time and EHR interoperability plays an important role to help Intel achieve this 
vision. In 2013, Intel launched the Connected Care program in Albuquerque, New Mexico. It is 
essentially an employer-sponsored and -facilitated accountable care organization (ACO). In focus groups, 
we heard from our employees and families that they wanted streamlined access to primary care and 
specialists. In response, Intel significantly changed its relationship with the healthcare system in the 
Connected Care Program. We contracted directly with the healthcare supply chain, removing middle men. 
We built a network of ! 1 primary care medical homes, including an onsite clinic, and medical 
neighborhood of specialists and facilities. To ensure timely access to care, Intel and Presbyterian Health 
Services agreed on protocols for call responsiveness and established acceptable levels of appointment 
availability. We contracted directly with Presbyterian Health System in an arrangement that aligned 
incentives and shared risk, with outcomes measured according to the following accountability metrics: 

• Right care: Use of evidence-based medicine to improve population health, focusing on diabetes, 
hypertension and depression. 

• Right time: Timely access to care in the optimal setting, including a nurse hot line. 
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• Best outcome: Patient satisfaction 1 00 percent of the time. 

• Right price: Material decrease in the cost of cmc, per patient per month. 

• Best life: Rapid return to productivity. 

Employee response has been excellent: More than 3 in 4 eligible employees opted to join the Connected 
Care Program. So far, major successes have included greater member engagement with the healthcare 
system, very high satisfaction ratings, and statistically significant improvements in diabetes control. We 
have yet to demonstrate an improvement in costs. In the long term, we believe that promoting proactive 
primary care with deep patient engagement and accountability should improve health outcomes and costs 
as we iterate this program. 

Successful preliminary results in New Mexico drove the decision to scale Connected Care to Oregon and 
Arizona. These locations which integrated multiple institutions and sites had a deeper need for sharing of 
our employees’ electronic health records. With our healthcare partners, we addressed the data liquidity 
problem head-on tlirough contracts that called for seamless care that required data sharing across 
institutional boundaries. 

The Connected Care interoperability team at Intel selected the Direct messaging standard and the 
Healtheway eHealth Exchange (recently renamed The Sequoia Project) to support the business and 
clinical requirements for coordinated care. The Connected Care data exchange model utilizes the HL7 
Consolidated Clinical Documentation Architecture (C-CDA), which is a key part of the data 
interoperability specifications in Meaningful Use. The EHR interoperability model in Oregon is 
nationally recognized for having an innovative approach for point-of-care access to electronic health 


records. New care coordination workflows are using data exchange with healthcare information coming to 
them in real time, resulting in quicker access to care with less work for everyone involved. Having the 



35 


most up-to-date healthcare data means a more efficient model where physicians and patients can now 
make the best possible choices about their care planning, leading to lower costs over time. And, critically, 
this data exchange model is enabling consumer health pilots that will improve Intel employee experience 
and improve health engagement. 

We relied upon the security, authorization and privacy measures governed by national standards (eHealth 
Exchange/HHIN and Direct messaging), and HIPAA for exchange of clinical records. This includes end- 
to-end encryption of data, authorization, PKI/digital signatures and appropriate access controls. The 
underlying technology standard is called SAME, which is used to assert authentication of the user. 
Members of the eHealth Exchange secure their communications using x.509 certificates whose chain-of- 
trust begins with the same Root Certificate Authority (CA), thus facilitating trust between organizations 
without the need to exchange certificates. 

Results: Tens of thousands of records are being queried and exchanged for our 33,000 employees in the 
Connected Care Program. For more specific information on the interoperability challenges and the value 
provided from joining Healtheway/Sequoia for a query-based system, Intel, Kaiser Permanente, and 
Providence Health and Services, The Portland Clinic and Premise Health have produced a white paper 
accessible at the following URL: https://www-ssl.intel.com/'content/ww\v/us/ea'hcaltlicare- 
it/advancing-interonerabilitv-healthcare-paper.html . I’d like to re-iterate that Intel is making this 
happen as we speak - with today’s EHRs, today’s standards, today’s health information exchanges and as 
an employer within today’s healthcare system. 

How could the federal government use its contracting power to achieve interoperability for 
beneficiaries of the Department of Defense, Department of Veterans Affairs, Centers for Medicare 
and Medicaid and Office of Personnel Management or for the hundreds of thousands of 
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government workers receiving federal health benefits? We have a tried and tested playbook for 
federal provider contracting that could be a model for both government and private industry. 

Next rd like to shift toward enabling the future. Precision medicine is an emerging approach for disease 
treatment and prevention that takes into account the individual variability in genes, environment, and 
lifestyle for each person. 

Intel’s work in precision medicine 

Intel and Oregon Health & Science University (OHSU) recently announced the Collaborative Cancer 
Cloud, a precision medicine analytics platform that allows medical institutions to securely share insights 
from their private patient genomic data for potentially lifesaving discoveries. Intel announced that key 
technology components of the Collaborative Cancer Cloud (CCC) will be opened sourced. Hospitals and 
research institutions of all sizes could use the technology to advance personalized cancer research. They 
can also apply it to advance personalized research in other diseases that are known to have a genetic 
component, including Alzheimer’s, diabetes, and more. Intel and OHSU also announced that they will 
partner with two other large cancer institutions to extend this capability in 2016. 

The project combines next-generation Intel technologies and bioscience to enable solutions that can be 
used to make it easier, faster, and more affordable for developers, researchers, and clinicians to 
understand any disease that has a genetic component, starting with cancer. It will enable large amounts of 
data from sites all around the world to be analyzed in a distributed way, without having to move the data 
itself, preserving the privacy and security of that patient data at each site. The end goal is to empower 
researchers and doctors to help patients receive a diagnosis based on their genome and potentially arm 
clinicians with the data needed for a targeted treatment plan. By 2020, we envision this happening in 24 
hours — a challenge to the computing and life science industries that we call All in One Day. The focus is 
to help cancer centers worldwide — and eventually centers for other diseases — share with one another 
the insights that reside in their private clinical and research data without having to share the data itself. 
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This approach is designed to protect data privacy and the business models of the research centers while at 
the same time unlock the insights from far larger dat^ts to benefit research and inform the specific 
treatment of individual patients. 

Building and Acceleratin2 the Health and Healthcare Internet of Things 

Today, we often think of EHRs or health and medical devices in isolation or closed networks: Can we get 
the EHR from one clinic or hospital to talk to the one across the street? Does that infusion pump talk to 
that monitor? And we build and maintain a lot of interfaces. 

But that’s all changing as the Internet of Things takes hold and we connect “smart” devices to the internet 
in ways that generate data that can be analyzed and turned into valuable insight. Driven by dramatic 
reductions in the cost of sensors, computing and bandwidth and the drive for improved cost and 
efficiency, we will have a smart energy grid, smart transportation network and. . .we hope. . .a smart 
healthcare system. All in all, these trends will unleash the lOT opportunity impacting the way we work 
and the way we live. Some estimate that by 2020, there will be 50B smart devices with 212B sensors 
generating 44 ZB of data. 

Intel and key global partners collaboratively identified five critical loT tenets which describe how 
endpoint devices should connect to the cloud: 

• Security as the Foundation: With billions of internet-connected devices by 2020, it is important 
that loT is secure from the sensor to the cloud, including all hardware and software. 

• Connectivity, Device Discovery, and Provisioning: Billions of devices cannot be managed 
manually. Rather, devices need to be able to communicate their “status” to the rest of the system 
independently. 

• Data Normalization: With so many different data types, there must be some level of 
interoperability between devices such that they are speaking the same language. 
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• Actionable Analytics: The data must be turned into meaningful information through analytics. 

• Monetize Hardware, Software, and Data Management; The loT infrastructure must be built to 
allow developers to manage and monetize innovative applications and services. 

To better illustrate these principles, let’s look at Intel pilots with specific healthcare applications. 
Intel’s work with consumer-generated health data: 

The Michael J. Fox Foundation for Parkinson’s Research (MJFF) and Intel Corporation are collaborating 
on improving research and treatment for Parkinson’s disease — a neurodegenerative brain disease second 
only to Alzheimer’s in worldwide prevalence. The collaboration includes a multiphase research study 
using a new big data analytics platform that detects patterns in participant data collected from wearable 
technologies used to monitor symptoms. This effort is an important step in enabling researchers and 
physicians to measure progression of the disease, improve medication adherence and speed progress 
toward breakthroughs in drug development. 

With wearable technology, the potential to collect and analyze data from thousands of individuals on 
measurable features of Parkinson’s, such as slowness of movement, tremors and sleep quality, could 
enable researchers to assemble a better picture of the clinical progression of Parkinson’s and track its 
relationship to molecular changes. Wearables can unobtrusively gather and transmit objective, 
experiential data in real time, 24 hours a day, seven days a week. With this approach, researchers could go 
from looking at a very small number of data points and burdensome pencil-and-paper patient diaries 
collected sporadically to analyzing hundreds of readings per second from thousands of patients and 
attaining a critical mass of data to detect patterns and make new discoveries. It is a dramatic shift from 
data-poverty to data- wealth — and in my view it signals the future of research and discovery. 

MJFF and Intel share a commitment to increasing the rate of progress made possible by open access to 
data. The organizations’ aim to share data with the ^eater Parkinson’s community of physicians and 
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researchers as well as invite them to submit their own de-identified patient and subject data for analysis. 
Teams may also choose to contribute de-identified patient data for inclusion in broader, population-scale 
studies. 

What could government do to extend the Parkinson trial to the thousands of Medicare patients 
suffering from the disease? 

Unfortunately CMS has virtually no payment codes to provide services for the MJFF trial described 
above. However, Congress is recognizing the need for payment reform to encourage Medicare 
reimbursement for wearables and remote patient monitoring devices for patients with chronic disease 
through legislation as outlined by HR 4442, the CONNECT for Health Act introduced by Reps. Black, 
Harper, Welch, Thompson and Blumenauer. 

Intel’s YOU.24X7 Study 

The YOU.24x7 Study, a 6-month observational pilot study of nearly 500 participants uses an end-to-end 
prototype platform consuming patient-generated data for research into health trends and behaviors to 
analyze cardiovascular risk factors and potentially improve outcomes. Patient data are collected through a 
number of devices: a Basis watch to track sleep and activity, plus blood pressure and weight scales in the 
home. These data are combined with electronic medical record information, labs and other key metrics to 
give more holistic view of the population. Data scientists and cardiologists are using an advanced 
analytics platfonn created by Intel, looking at the de-identified data to gain trending and correlation 
insights into cardiovascular wellness. Meanwhile, the individual participant has 24x7 access to all of his 
or her own information through the secure personal health collaboration hub. 

As an employer faced for years with unsustainable healthcare cost inflation for the 53,000 employees we 
are proud to employ in the United States and their 88,000 Intel Health Plan dependents, Intel has initiated 
these projects for business reasons — both to support a healthy, productive workforce and to grow the 
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global market for the powerful computing needed to scale precision medicine. We hope these programs 
can become examples for the rest of the country to build upon. 

Congressional action is needed to ensure that these positive examples using Health IT innovation 
are options for Medicare patients across the country. 

1) Sustain momentum toward standards and interoperability for today and tomorrow: As 

Intel’s Connected Care Interoperability team demonstrated, a standards-based approach for health 
information technology enables quicker and more efficient deployments to share data from 
different sources. This provides scalability, interoperability, and innovation as new services can 
be built upon a common framework of standards, data models and clinical vocabularies. Intel 
supports an implementation specification compatible with baseline standards that are specific, 
well-documented, tested vigorously, and shared publicly, as described in HR 6, the 21st Century 
Cures Act. 

Intel invites policymakers to consider standards and interoperability efforts beyond EHRs 
(electronic health records) and into the domain of the health and healthcare Internet of Things 
(loT) through encouraging recognition and active federal participation in industry-led initiatives 
such as Industrial Internet Consortium (TIC), OCF (Open Connectivity Foundation), ICE 
Alliance, Continua and other organizations. 

2) Encourage patient engagement by removing obstacles for patients to access and share their 
data. With the adoption of electronic health records comes enormous potential for creating value 
from data held in millions of patient records. Today, the use of this information is regulated by a 
series of highly regulated consent requirements constructed by not only the federal government, 
but by states. Intel invites policymakers to partner with industry to pursue a standardized machine 
readable consent fonn to allow patients to donate their data to ongoing research without the need 
for securing and faxing consent forms each time patient data is requested. The International Rare 
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Disease Research Consortium has r«;ognized this problem. The Consortium has assembled a 

task team from the Global Alliance for Genomics and Health to explore the machine readability 

of consent and its impact on data use and acc^sibility. PCORI has launched research into patient 

preferences for consent,^ as well as other gov^nment and private industry initiatives. 

3) Continue to push toward value-based care: We support the HHS goal announced last year to 

move 30 percent of care to alternative payment models by 2016 and to 50 percent by 2018. When 

incentives are aligned toward value-based care and managing population health, the demand for 

information-sharing goes up. Fee-for-service models work the opposite way, in which providers 

are paid based on the volume of service they deliver. Based upon Intel’s experience with 

Connected Care, we have seen increased patient engagement and better outcomes based upon 

shared risk, shared goals and consistent metrics for success. As the U.S. healthcare system moves 

to outcome-based payments through the Medicare Access and Chip Reaulhorization Act 

(MACRA), Congress can assist through providing funding for new care delivery tools for training 

and discovery until the 20 1 9 implementation date for remote patient monitoring (RPM), which 

remains mostly unpaid in today’s fee-for-service environment in spite of studies showing as much 

as a 75 percent reduction in hospital readmissions when provided to chronic care patients.^ 

4) Facilitate the right mechanisms and incentives for managing and reducing cyber security risk: 

Open collaboration and communication among regulators, industry medical and healthcare 

practitioners are key to managing and reducing cyber security risk. Public-private partnerships have 

proven to be successful in helping a wide range of industries improve their cyber security readiness 

and overall capabilities in the past. More recently, the NIST Cybersecurity Framework has provided a 

tool for healthcare organizations to review their security posture with a focus on risk management. 

The Framework provides an organization the ability to evaluate its current security posture, create a 

^ http://www.pcori.org/research-resuits/2014/demonstrating-re5pect-and-acceptabie-consent-str3tegies-what- 
matters-patients 

^ http://healthaffair5.org/blog/2014/04/04/the-roie-of-remote-care-management-in-population-heaith/ o 

http;//www.teiehealthresourcecenter.org/sites/main/files/file'attachments/snell-smal!ey_hospital_-physician- 

summit-feb-2013.pdfr 
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target for risk tolerance and allow the organization to develop a path towards achieving the target. 

The U.S. Department of Health and Human Services’ (HHS) mapping between the HIPAA Security 
Rule and the Framework through an effort developed in conjunction with NIST and the Office of the 
National Coordinator for Health IT (ONC) provides a means for healthcare organizations who have 
aligned their security programs to the HIPAA Security Rule to be able to use the Framework to 
identify and address gaps in their security. Collaboratively developed efforts such as the NIST 
Cybersecurity Framework provide real benefits to healthcare organizations wishing to better 
understand and improve their organization’s cyber risk management processes and posture. Security 
must be stressed at the outset, rather than as an afterthought in the design process. 

Cyber security must be baked into the equipment, systems and networks at the very start of the design 
process - intrinsic to an organization’s thought processes, its business processes, and its design, 
development, and manufacturing processes. It must be embedded in a product or network element so 
that it becomes an integral part of the product’s or element’s functioning. This approach is not only 
more effective; it is less cumbersome and less expensive than trying to lock down systems that are 
inherently insecure after the fact, as has happened all too often in the past in a wide variety of 
industries, including health care. 

While Information Sharing and Analysis Organizations (ISAOs) and associated liability protection for 
participation have been proposed to allow increased sharing of information on cyber threats among 
private sector participants, such proactive information sharing could be a valuable tool in preventing 
cybercrimes. Gaining active participation in such organizations - whether in support of cybersecurity 
or patient safety - will require carefully crafted mechanisms and incentives. 

5) Ensure privacy as an enabler of innovation; Intel believes that privacy is a key enabler of 

innovation in this sector. If individuals are to feel at ease with these technologies and data uses, they 
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must trast that their devices are secure and data about them is protected and used in privacy respectful 
ways. Intel endorses the application of long recognized, proven principles of fair information 
practices to address concerns about data practices and privacy. Intel further endorses implementation 
of "privacy-by-design" - that is, addressing privacy and building in privacy solutions throughout the 
design cycle of technologies and data applications. 

Privacy and progress in this sector are not values to be balanced or traded off - they are goals that 
must be pursued in tandem if we are to realize the benefits these technologies promise. 

We thank the Committee for inviting Intel to address Congress on the important contributions being 
made today in the diverse realm of Health IT and for considering our recommendations on how to 
accelerate deployment. 

Matthew Quinn. Federal Solutions Director 
Health and Life Sciences 
Intel Corporation 
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Mr. Hurd. Mr. Quinn, I appreciate your opening remarks. 

Now Mr. DeCrescenzo is recognized for 5 minutes. 

STATEMENT OF NEIL DeCRESCENZO 

Mr. DeCrescenzo. Thank you. Mr. Chairman, members of the 
committee, it is a privilege to be here today. 

My name is Neil DeCrescenzo. I am the president and CEO of 
Change Healthcare. Perhaps our name says it all. 

Change Healthcare is headquartered in Nashville, Tennessee, 
provides its services in all 50 States, and has over 50 offices nation- 
wide. We are a leading provider of software and analytics, network 
solutions, and technology-enabled services that optimize commu- 
nications, payments, actionable insights that enable smarter health 
care. 

By leveraging our Intelligent Healthcare Network, which is one 
of the largest financial and administrative networks in the United 
States health care system, payers, providers, and pharmacies are 
able to more effectively manage complex workflows that support 
value-based health care. 

While I am proud to represent the nearly 7,000 people of Change 
Healthcare, I am testifying today in my role as a member of the 
executive committee of the Healthcare Leadership Council, a coali- 
tion of leading companies and organizations from virtually every 
sector of American health care. In that role, I would like to share 
a few thoughts on the role and capability of health information 
technology to transform our Nation’s health care system for the 
better. 

As increasingly is the case in most fields, health care improve- 
ment today is driven by data. If our health care system is not im- 
proving at the pace any of us would like, this is in large part due 
to barriers standing in the way of access to data, the ability to 
share information, and the utility of this information for con- 
sumers, providers, payers across the health care continuum. 

Our HLC member companies know from firsthand experience 
that data interoperability can strengthen care coordination, ena- 
bling providers, payers, pharmacists, laboratories, and others, to be 
on the same page when treating a patient. It can boost progress to- 
ward an outcome-driven, value-based payment system to replace 
the outdated and inefficient fee-for-service status quo while also 
improving our quality measurement capabilities. 

With interoperability and access to clinical and claims data, we 
can accelerate medical research and give hospitals and physician 
offices real-time access to comparative effectiveness findings. An 
interoperable system can improve care to rural and underserved 
areas of the country through improved telehealth and remote pa- 
tient monitoring. Wellness and prevention will also be enhanced 
through the better use of patient-generated data. 

This future is promising, exciting, and imminently obtainable, 
once we address some of the obstacles standing in our way. 

Last year, HLC, under the auspices of its National Dialogue for 
Healthcare Innovation initiative, brought together leaders from 
over 70 organizations representing government, industry, patients, 
employers, and academia. There we built consensus on how we can 
move closer to this desirable data-driven future. 
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Last month, we announced the consensus recommendations 
emerging from this effort, a number of which are relevant to to- 
day’s discussion. 

On data interoperability, we believe that a firm date of December 
31, 2018, should be established by which health information is 
widely shared among electronic health record systems nationwide. 
We have the capability to reach this goal in the near term, not a 
decade from now. Progress toward this nationwide data infrastruc- 
ture should be driven by private sector innovation, with emphasis 
placed on secure data-sharing to protect patient privacy, common 
standards and governance, and a ban on data-blocking. 

In addition, we believe that Congress and the administration 
must address physician health referral laws and Federal anti-kick- 
back statutes, as well as civil monetary penalty laws. 

These fraud and abuse protections were built for a fee-for-service 
world, but today, they often stand as barriers to the kind of collabo- 
ration and information-sharing that is essential for value-based 
health care approaches and for improving patient care. 

Another barrier to data-sharing is the multitude of diverse and 
often contradictory Federal and State laws regulating health infor- 
mation that exist alongside the Federal HIPAA regulations. We be- 
lieve these national and State privacy laws and regulations should 
be harmonized to facilitate greater information-sharing for the ben- 
efit of patients while still protecting their confidentiality. 

Members of the committee, I would like to close by applauding 
you for conducting this hearing and your focus on the issues that 
can genuinely transform and improve health care for every Amer- 
ican. 

We can move faster. We can move more collaboratively across the 
spectrum of U.S. health care. And we can help more Americans 
maintain or improve their health better than we do today through 
data, information, and insights. 

We look forward to working with you toward our shared goals, 
and I will be happy to take your questions. Thank you. 

[Prepared statement of Mr. DeCrescenzo follows:] 
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Mr. Chairman and members of the committee, thank you for the opportunity to testify 
today on the importance of heaith information technoiogy and how we can enabie a 
future that takes fuii advantage of the potential of eiectronic heaith information. 

My name is Neii de Crescenzo and I am the President and CEO of Change Healthcare. 
Change Healthcare is headquartered in Nashville, Tennessee, provides its services in 
all 50 states and has over 50 offices nationwide. We are a leading provider of software 
and analytics, network solutions and technology-enabled services that optimize 
communications, payments and actionable insights that enable smarter healthcare. By 
leveraging our Intelligent Healthcare NetworkTM, which is the single largest financial 
and administrative network in the United States healthcare system, payers, providers 
and pharmacies are able to increase revenue, improve efficiency, reduce costs, 
increase cash flow and more effectively manage complex workflows that support value- 
based healthcare, I am proud to represent the nearly 7,000 people of Change 
Healthcare. Today I am pleased to be here in another important role that I have as an 
Executive Committee Member of Healthcare Leadership Council. 

HLC is a coalition of chief executives from all disciplines within American healthcare, it 
is the exclusive forum for the nation’s healthcare leaders to jointly develop policies, 
plans, and programs to achieve their vision of a 21 st century health system that makes 
affordable, high-quality care accessible to all Americans. Members of HLC — hospitals, 
academic health centers, health plans, pharmaceutical companies, medical device 
manufacturers, biotech firms, health product distributors, pharmacies, post-acute care 
providers, and information technology companies — advocate measures to increase the 
quality and efficiency of healthcare by emphasizing wellness and prevention, care 
coordination, and the use of evidence-based medicine, while utilizing consumer choice 
and competition to enhance value. 

I am speaking here today, in part, because of my role in leading HLC's National 
Dialogue for Healthcare Innovation (NDHI) effort. HLC created NDHI to allow industry, 
patients, employers, academicians, and government to examine, discuss, and build 
consensus on how to address the most important issues affecting the course of 21st 
century healthcare. 

On March 2. 201 5, NDHI convened an unprecedented summit with leaders of more than 
70 of the most influential public and private organizations in healthcare to identify the 
barriers impeding progress toward a high-value, innovation-driven healthcare system, 
and discuss how to remove those barriers. This was an important meeting that 
atypicaiiy focused not on a single, narrow healthcare issue, but rather on how to create 
a sustainable system equipped to address persistent cost and quality challenges. Many 
of the priorities that emerged from these talks are relevant to the discussion here today. 
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INTEROPERABILtTY 

HLC members are united in our belief that interoperability of electronic health 
information exchange will make American healthcare more affordable and accessible, 
that it can reach higher levels of quality, and that it can achieve better health outcomes 
for individuals and populations. We believe that these objectives can and must be 
attained through interoperable information exchange and built on innovation that has 
defined private sector healthcare for generations. 

HLC mernbers feel strongly that any discussion of interoperability should be firmly 
grounded in real-world applications of technology. Interoperability is not a goal unto 
itself - it is a means to achieve many of our long-held ambitions for a healthcare system 
that better serves patients, prevents errors, increases value, and improves quality of life. 
Interoperable health systems have the potential to drive progress in: 

■ti 

• Care Coordination / Patient Centered Interoperability: The first goal of 
interoperability must always be a positive patient experience that helps them 
maintain and improve their health. Individuals directly in contact with the patient 
or the patient’s health information must be able to share relevant information with 
one another as well as the patient, regardless of geographic location or 
healthcare setting. This information sharing needs to be both timely and 
bidirectional. Interoperation also needs to be expansive— included in this 
connectivity should be the health information systems of providers, pharmacists, 
payers, IT connected medical devices, laboratories, and other ancillary services 
providers — when appropriate. Through this coordination, the patient experience 
will improve, medical errors will be reduced, and illnesses better treated or 
prevented. 

• Value-Based Payment: As initiatives by the private and public sectors accelerate 
our shift from volume-based healthcare payments to outcomes-driven, episodic 
payments, stakeholders must have access to relevant data to support the shifts 
in cafe paradigm that drive these new payment models. Broader interoperation 
and integration between organizations will expand the potential and appeal of 
alternative payment models - driving value and better outcomes in our 
healthcare system. 

• Quality Measurement: Effective interoperation among information-holding 
entities is critical for the alignment of metrics across various government and 
private sector programs. HLC supports efforts to streamline quality measures to 
focus on a small, limited core set of quality measures to reduce data collection 
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costs and administrative burden for providers and payers. These measures 
should be outcome-focused (rather than “process-focused” measures) endorsed 
by a consensus body, and aligned across health organizations and systems. 
Interoperation among systems is necessary for these measures to capture data 
proving the efficacy and long-term value of interventions on patient outcomes. 

• Clinical and Claims Data Sharing for Research: Interoperation of clinical data 
has the potential to accelerate the learning health system by orders of 
magnitude. As demonstrated by large private sector health systems as well as 
the Patient-Centered Outcomes Research Institute's (PCORI) National Patient- 
Centered Clinical Research Network (PCORnet), interoperation can substantially 
ease the appropriate access to data from electronic health records to conduct 
comparative effectiveness research using large, real-time datasets from a variety 
of healthcare settings, including hospitals, doctors' offices and community clinics. 
Legal and confidentiality issues as well as careful consideration on how to obtain 
patient consent must continue to be taken into account when using clinical data; 
however, interoperating systems using a common clinical data set could 
significantly lower technical barriers to this type of research. Academic medical 
centers, pharmaceutical and device manufacturers, payers, and others could 
benefit from expanded clinical data access through interoperability. 

• Telehealth and Remote Patient Monitoring-. One of the most important outcomes 
of an interoperational system should be the increased ability to utilize telehealth 
and remote patient monitoring (RPM) throughout the care system. This will 
enable better provision of care, particularly in rural or underserved areas, at a 
lower cost, while coordinating care among multiple providers. Additional detail 
on regulatory barriers which currently stymie wider teleheaith adoption is 
provided later in this testimony. 

• Wellness and Prevention: Interoperation can provide the basis for dramatic steps 
toward improving the wellness of all consumers and patients. At a population 
health level, it would allow for better disease detection and surveillance, which 
would inform both clinical responses as well as scientific advances. With 
interoperable patient devices, health care providers could make better use of 
patient-generated data. 


Keys to Patient-Centered Interoperability 

In an effort to show how all stakeholders can move towards an interoperable system, 
the NDHI effort identified three key goals to support patient-centered interoperability that 
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are shared across the public and private sectors. Together, these keys will move the 

U.S. toward achieving a patient-centered interoperable health system 

• Key #1: Secure Data 
Sharing: Secure data sharing 
ensures that patients' privacy 
is protected in the process of 
data exchange~and while the 
data is stored. 

• Key # 2: Common Standards 
and Governance for Trusted 
Exchange: Consistent 
implementation of standards 

■ to establish the language, 
structure, and data types 
required for integration 
among systems is necessary for interoperability. These standards must be 
accessible and capable of adapting to changing healthcare technology. 

• Key #3: Systems are Not Configured to Information Block: HLC CEOs have made a 
commitment not to “information block”, by knowingly and unreasonably interfering 
with the exchange or use of electronic health information. Information blocking can 
lead to a variety of unfortunate outcomes, such as: 

o Compromising patient safety, care quality, and treatment effectiveness 
because it withholds information from patients and providers for informed 
decision making; 

o impeding progress towards reforming healthcare delivery and payment 
because sharing information seamlessly across the care continuum is 
fundamental to moving to a person-centered, high-performing healthcare 
system; 

o Undermining consumers' confidence in their healthcare providers by 

preventing individuals from accessing their health information and using it to 
make informed decisions about their health and healthcare; and 

o Preventing advances in biomedical and public health research, which require 
the ability to analyze information from many sources in order to identify public 
health risks, develop new treatments and cures, and enable precision 
medicine. 



4 


51 




- 


*iV- 






.i^-CS'«M.i.^Aorwy 

-Nhr^y^> 

A-.X AA^Mf'* 


3»fc, iM »v'n>o*'i m 
'V \,--'-V «W *ilb*«.fcS 

SXN‘*'ni(*i •r •an, I 

^ r aH.V«. r * 


^K^ys to- htewc i 'v' 
# Private Secmr Examples 
©Public Sector Inmatives 


HLC Principles on Interoperability 


In 2014, the CEOs of HLC came together and agreed to take steps toward an 
interoperable health IT infrastructure that is both beneficial to consumers and workable 
for the industry. Functional interoperability is a critical component to support patient- 
centered care, value, and continued innovation in healthcare. 


To support these goals, we made the following declaration to Congress, the 
Administration, and our peers in the healthcare system: 


• Policymakers should encourage exchange of material and meaningful health 
data through the use of technologies and applications that enable bidirectional 
and real-time exchange of health data currently residing in electronic health 
record (EHR) systems (e.g., open and secure API technology). 

• Policymakers should use appropriate authority to certify only those EHR 
technology products that do not block or otherwise inhibit health 
information exchange. The HHS Office of the National Coordinator should 
decertify Meaningful Use products that intentionally block the sharing of 
information, or that create structural, technical, or financial impediments or 
disincentives to the sharing of information. 

• The federal government, in collaboration with the private sector, should build on 
current and emerging best practices in patient identification and matching 
to identify solutions to ensure the accuracy of every patient’s identity, and the 
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availability and accessibility of their information, absent lengthy and costly efforts, 
wherever and whenever care is needed. 

• Any interoperability requirements or incentives should be “technology 
neutral” and focused on outcomes - active interoperation between and among 
systems — rather than on the adoption or use of specified technologies. It is 
critical that future policies do not stifle potential innovations in health system 
connectivity. 

HLC strongly encourages a continued focus on outcomes-based approaches to 
measuring progress in interoperability. The ability to exchange health information is not 
necessarily the same as actual interoperation — meaning patient and provider- 
authorized information exchange — between and among the many disparate health IT 
platforms in use today and in the future. A limited role for the federal government may 
be needed to assist in identifying standards in limited key areas including patient 
identifiers, terminologies, clinical data query language, security, open application 
program interface criteria, arid clinical decision support algorithms, among others. 

NDHI Interoperability Work 

In 201 5, the multi-sector members of NDHI felt that recent advances in the state of 
private sector-led interoperability collaborations and technologies allowed for even more 
ambitious goals and recommendations. NDHI members agreed to build upon 
recommendations already offered to Congress and the Administration by HLC to 
continue to work toward achieving an interoperable health IT infrastructure. Based 
upon these impressive accomplishments, members endorsed two additional 
declarations: 

• There should be a national objective to achieve widespread exchange of 
health information through interoperable EHR technology nationwide on or 
before December 31, 2018 (in parallel to the recommendation made in the 
Medicare Access and CHIP Reauthorization Act). 

• Consumers should have easy and secure access to their electronic heaith 
information, be able to direct it to any desired location, learn how their 
information can be shared and used, and be assured that this information will be 
effectively and safely used to benefit their health and that of their community. 

Interoperability Conclusion 

As efforts to reform our healthcare system accelerate, all parts - public and private - 
must move in tandem. Interoperability is also key to achieving the laudable goal set by 
HHS of tying 50% fee-for-service Medicare payments to quality or value through 
alternative payment models, such as Accountable Care Organizations (ACOs) or 
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bundled payment arrangements by the end of 201 8. HHS has also set a goal of tying 
85% of all traditional Medicare payments to quality or value by 201 6 and 90% by 201 8 
through programs such as the Hospital Value Based Purchasing and the Hospital 
Readmissions Reduction Programs. The success of these models in the healthcare 
system hinges on the deployment of seamless information sharing across all 
participants. 

Meaningful interoperation is a necessary tool to meet the ambitious goals laid out by 
both private sector organizations and the federal government to enact value-based 
payment reforms, new care models, and allow greater consumer access and control of 
their healthcare. These goals can best be accomplished through private sector 
leadership, with government serving in an outcome-focused guiding role. 


BARRIERS TO HEALTH INFORMATION FLOW 

There is growing interest in using data to better understand how to optimize the practice 
of medicine, the delivery of healthcare and new approaches to wellness and prevention 
of illness. At the same time, these new innovations must be balanced with the federal 
government’s concerns about interoperability and the public’s concern about the 
confidentiality and use of health data. 

As data are accessed, it is vital to understand how to safely use these data to generate 
information for evidence-based care, share the data appropriately, analyze the data, 
and predict future needs of our complex healthcare delivery system. These data are 
fundamental to designing, implementing and evaluating innovative approaches to 
payment and financing reform and value-based delivery system reform, as well as 
medical breakthroughs. 

Allow data-driven accountable care models to flourish by reforming legal barriers 
to cooperation and care delivery innovation 

As the healthcare system transforms to reward better value and a more empowered 
consumer, the NDHI initiative has found that some laws and regulations that were once 
important to the healthcare system may no longer be applicable or may inhibit 
transformation efforts in unintended ways. Laws designed to prevent anticompetitive 
behavior in a fee-for-service environment, for example, now sometimes hinder the 
coordination needed for the best patient care. 

In general, the fraud and abuse legal framework is designed to penalize arrangements 
between and among providers and other industry stakeholders that have the potential to 
encourage overutilization of healthcare resources, inappropriately influence provider 
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decision-making, decrease competition among competitors, and harm patients. To 
improve quality of care and reduce costs, new care delivery and payment models are 
designed to encourage greater coordination of care and payment among providers and 
other industry stakeholders. These models may align financial interests in ways that 
conflict with outdated fraud and abuse laws and regulations. 

Many federal statutes and regulations are potentially implicated by these new models, 
including; the Federal Anti-Kickback Statute and Physician Self-Referral (Stark) Law, 
Civil Monetary Penalties (CMP) Law, the Civil and Criminal False Claims Acts (FCA), 
HIPAA, antitrust and tax law, and state laws that overlap with, mirror, or relate to these 
federal laws. 

Through the work of the NDHI initiative, participants agreed upon two realistic legisiative 
priorities: 

• Require the Department of Health and Human Services Secretary to review and 
assess the Federal Anti-Kickback Statute and Stark Law as well as the Civil 
Monetary Penalties (CMP) Law in the context of health system transformation, 
specifically addressing whether the laws create unnecessary barriers to new 
integrated care models and whether these laws are effective in limiting fraudulent 
behavior. Changes identified through this assessment may yield opportunities to 
amend fraud and abuse laws to foster healthcare arrangements that promote 
Increased quality and lower costs. 

• Grant the HHS Office of the Inspector General (OIG) and CMS broader flexibility 
and discretion to develop exceptions and safe harbors to the Federal Anti- 
Kickback Statute and the Stark Law consistent with current health policy 
objectives (e.g., increased efficiency and quality, decreased cost). 

It is important to note that alignment of the fraud and abuse legal framework with new 
care delivery and payment models is being discussed at multiple levels across the 
healthcare system. The recent Medicare Access and CHIP Reauthorization Act of 2015 
(MACRA) called for the HHS Secretary, in coordination with the HHS OIG, to consider 
possible modifications to the legal frameworks to better align with integrated care 
delivery and payment models. 

Patient Matching 

As mentioned previously, patient identification and matching that works wherever and 
whenever care is needed is a critical component of successful interoperation and 
improved health outcomes. The federal government must work with the private sector 
to build on current and emerging best practices to identify solutions that ensure the 
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accuracy of every patient’s identity, and the availability and accessibility of their 
information, without lengthy and costly effort. 

Without a systematic means of matching the right record to the right person, providers 
may have an incomplete view of a patient’s medical history. This could result in 
compromising the patient’s safety, care may not be well coordinated with other 
providers treating the patient, patient records may be overlaid, unnecessary testing or 
improper treatment may be ordered, and patient confidence may be eroded. The 
inability to match patients to their records may also cause providers to face costly 
clinical workflow inefficiencies and potential inaccuracies including ordering duplicate 
tests. For EHRs to deliver on the promise of interoperability and better healthcare, they 
need to ensure that patient data are sent and received easily among providers across 
disparate systems. These shared records must be accurate and useable. 

The potential benefits of successfully matching a patient to their health information 
across all care settings cannot be understated. It is critical to health information 
interoperability efforts, critical to providing a patient a comprehensive health record 
upon request, and critical to ensuring that health professionals have the information to 
safely and effectively treat patients. More effective patient matching could lower 
healthcare costs by preventing redundant tests and scans, and more effectively prevent 
adverse events caused by medication interactions. The private sector has taken steps 
forward to reach these goals, but federal legislators need to facilitate government 
cooperation in ensuring success in building this infrastructure nationally. 

Congress can facilitate this by removing the annual appropriations provision prohibiting 
the use of federal funds to promulgate a unique health identifier until legislation is 
specifically enacted approving it. While this provision is narrowly worded, it has 
discouraged federal agencies from fully joining in partnership with the private sector as 
we work to develop patient matching systems and standards. 

The Need for Consistent Legal Requirements for Health Information 

Various laws and regulations create restrictions on data movement and usage at the 
federal level, which often constrain providers from pursuing alternative payment models 
and even research initiatives. As health plans and providers and the medical research 
community continue to focus on outcomes research and innovation, it is important that 
the exchange and aggregated use of healthcare data be allowed. The HIPAA Privacy 
Rule strictly defines what constitutes protected health information (PHI) and defines 
certain institutions, or covered entities that hold such information. The Federal Policy 
for the Protection of Human Subjects or “Common Rule” defines the protection of 
human subjects in research. Without modifications to harmonize these rules, 
unnecessary barriers to data movement will continue to limit the innovative potential of 
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the healthcare marketplace, especially as PHI continues to migrate out of the traditional 
healthcare system. 

The misinterpretation and lack of alignment around privacy, security, and enforcement 
regulations -developed to safeguard patients’ personal health information - hampers 
data sharing necessary for better care coordination and medical research. Currently, 
researchers need to contend not only with the HIPAA Privacy Rule regulating research, 
but also with state law, and in many cases, additional federal law, for example, the 
Federal Privacy Act of 1974, the so-called Common Rule, FDA Regulations, and other 
regulations. This results in a confusing and inconsistent set of requirements, often 
governing the same study (for example, in the case of a multi-site study in different 
states), 

HIPAA was designed to ensure that individuals’ health information is protected while 
allowing the flow of health information needed to provide high quality healthcare. 

HIPAA was also designed to protect the privacy of individuals’ electronic health 
information while allowing the adoption of new technologies that will improve the quality 
and efficiency of patient care. 

We believe that the HIPAA privacy and security rules are, generally, serving patients 
and the healthcare system well and that they should continue to be the guiding rule 
wherever HIPAA-covered entities are involved. The law was designed to accommodate 
heath information flow and the adoption of new technologies while still protecting 
individuals’ health information. As healthcare payment and delivery systems evolve, 
and we gravitate toward greater use of electronic health records, we believe that HIPAA 
continues to be an effective policy foundation with which to govern the appropriate and 
effective use of patient healthcare data. 

However, as our nation embarks upon dramatic transformations in care delivery through 
new payment models and seeks to achieve full nationwide interoperability of health 
information, it is critical that we reconcile confusions and barriers that may be caused by 
conflicting privacy laws while remaining true to patient-serving goals and privacy 
protections. 

Inconsistent Legal Requirements for Health Information Across State lines 

One particularly burdensome barrier to nationwide health information exchange is the 
multitude of diverse - and often contradictory - state laws across the country regulating 
health information alongside HIPAA and other federal privacy laws. These various state 
privacy and information sharing laws create enormous complexity resulting in 
substantial impediments to the implementation of health information exchanges within 
and across state borders. 
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Healthcare organizations have long advocated for the harmonization of national and 
state privacy requirements in order to simplify compliance and facilitate greater 
information sharing. We believe that a broader harmonization effort that incorporates 
HIPAA governing standards would benefit the healthcare system without creating any 
material adverse impact on individuals. This work becomes increasingly important as 
Americans become more mobile and travel for specialized healthcare services. 

There has been excellent work done by the HHS Office of the National Coordinator 
(ONC) in connection with its important and visionary interoperability roadmap 
"Connecting Health and Care for the Nation". That roadmap outlines a vision and action 
steps for the harmonization of conflicting, confusing, and burdensome state privacy 
laws. This effort provides new hope for efforts to simplify the protection of health 
Information. Efforts to educate states on existing federal standards and begin a 
dialogue on this important problem are important. With regard to the critical actions 
outlined in the roadmap, we believe there is both precedent and will for an accelerated 
timeline with stakeholders acting alongside ONC. Planned discussions with nationwide 
stakeholders should include possible action items, such as implementation strategies to 
harmonize and simplify state and federal laws. 

Inconsistent Legal Requirements for Research 

Similarly, federal rules for human subjects’ research, combined with other privacy rules, 
create a complex and burdensome environment for research. For example, definitions 
between the HIPAA Privacy Rule and the interagency Common Rule for Human 
Subjects Research are not always consistent, creating ambiguity and confusion for 
researchers. There should be one harmonized privacy standard for research 
institutions so that research and innovation are not delayed. The federal government 
should streamline the internal review board (IRB) process, clarify researcher and IRB 
expectations with respect to the scope and intensity of IRB review, and focus IRB 
resources and attention on those studies warranting the most careful scrutiny. 

Government Data Sharing 

More than any other public or private entity, the federal government possesses the 
greatest volume of health data, in recent years, there have been strides made in 
making more of this information available to entities outside of the federal realm. The 
2009 Open Government Directive and the Department of Health and Human Services’ 
Health Data Initiative led to the sharing of valuable information from federal agencies. 
HLC specifically applauds efforts by Congress and HHS Centers for Medicare and 
Medicaid Services (CMS) to increase access to data held by the federal government for 
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health research through the Qualified Entity (QE) program and also the innovative 
Virtual Research Data Center (VRDC). 

We believe strongly that it is the obligation of government health agencies to maximize 
public benefit from data collected through their operations. Data collected from federal 
government programs, particularly those funding new and innovative care delivery 
models or tools, should be available for research, with appropriate privacy protections. 

We encourage increased coordination among federal government agencies and others 
to reduce data “silos” and simplify access processes and requirements. Easily 
accessed federal data sets, with appropriate privacy and security safeguards in place, 
provide fertile ground for innovative health services research, for entrepreneurs to 
create innovative new products, and for health care organizations to benchmark and 
evaluate performance across the healthcare system. 

Health Information Flow Recommendations 

In summary, there are several core needs that currently stand as detriments to fully 
integrating the use of health information into a learning, interoperable health system: 

• Create a single national definition for protected health information and privacy 
standard to protect patients and consumers while mitigating complications from 
contradictory state laws. 

• Update and harmonize federal privacy rules with regard to research to allow for 
simple, clear requirements for health organizations - many of which conduct 
research and drive innovation while providing care. 

• Support and cooperate with leading private sector organizations in their efforts to 
match the right patient to the right record with minimal time and effort. 

• As part of the “open government" initiative, the administration should further 
explore and encourage government-wide policies and standards for health data 
sharing. These would include uniform data access methods and usage 
agreements across federal agencies in order to simplify the process for 
organizations seeking data. 

Strategic and targeted harmonization of the application and enforcement of federal and 
state laws relating to health information privacy could help organizations engaged in 
providing and paying for healthcare keep health information private and secure, while 
avoiding the expense of unnecessary time and resources to meet overlapping burdens 
at the expense of other important efforts to improve healthcare quality. 
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BARRIERS TO TELEHEALTH 

HLC supports reexamining restrictive reimbursement and regulatory barriers that make 
it challenging to use teleheaith. Telehealth has been shown to improve healthcare 
quality and lower costs, while giving more people access to quality healthcare. 
Telehealth is already available in some circumstances, but expanding it to serve an 
even larger population is needed to further increase access to quality care. 

Benefits of Telehealth 

Poor health, treatment complexity, lack of access, the current (and projected) physician 
shortage, and even the cost of care can discourage patients from getting treatment that 
they need. In the case of chronic conditions, this is especially detrimental to health and 
reducing health costs, since so much of chronic disease care is based on early 
intervention and management, as well as care coordination. 

Telehealth is an alternative to traditional healthcare to treat basic, episodic medical 
conditions as well as chronic disease. Increased access to telemedicine would make it 
easier for providers to treat patients and improve continuity of care and care 
coordination by increasing access to medical care for beneficiaries unable to travel and 
addressing provider shortages in rural or other areas. Telemedicine has been shown by 
HLC members to improve healthcare quality and lower costs, while giving more people 
access to quality healthcare. Numerous studies on telehealth and remote patient 
monitoring (RPM) have shown benefits in quality care and cost savings. 

Current Telehealth Restrictions 

Regulatory barriers make it challenging to use telemedicine. Collectively, these are 
often referred to as “1834(m) restrictions” - and they include; limitations on the type of 
services provided, geographic location, the type of clinical site the patient is located in, 
type of institution delivering the services, and type of health provider. Store-and-forward 
technology (e.g., email) is not reimbursable except in Alaska and Hawaii, where it is 
permitted as part of a federal demonstration program. While RPM is already available 
in some circumstances, lack of common procedure terminology (CPT) codes and the 
requirement that RPM activities be bundled into other payments inhibit their widespread 
use. 

HLC Position 

• HLC strongly supports the lifting of the “1 834(m) restrictions” that prevent the 
widespread use of telehealth in Medicare. 

• For the Medicare Advantage (MA) program, HLC strongly supports telehealth’s 
inclusion as part of the basic benefit package and not limited to supplemental 


13 



60 


benefit funds available. Similarly, HLC supports providing ACOs the ability to 
expand use of telehealth. 

• HLC believes payment for telehealth services should always connect to the type 
of service being provided, not the method by which it is provided, so providers 
are able to choose the means which is most effective for each patient. 

We also urge Congress to avoid creating separate or additional telehealth-related 
quality measures. The type of service-delivery method should not detract from focusing 
on a small set of meaningful outcomes measures. Any statute should focus on the 
broad benefits of establishing connected care rather than restrictive reimbursement 
systems or parsing out a menu of connected care tools and approaches that may not 
keep up with current technology or best care practices. 

HLC strongly supports expanding the use of telehealth services without regard to 
geography or diagnosis to ensure that all beneficiaries are able to access quality, 
efficient and convenient telehealth services as appropriate. In general, HLC supports 
telehealth policy frameworks that are site-agnostic and not overly prescriptive. 

Providers should be able to determine if a patient can appropriately receive care via 
telehealth in a way that enhances care delivery and quality. 


CYBERSECURITY 

HLC members, who are leaders in every healthcare field, agree that cybersecurity is 
critical to protecting sensitive information that is at the crux of transformational changes 
underway in the healthcare industry. The movement to patient-centered, integrated 
care coordination requires efficient interoperation of health information technology, an 
engaged and active patient, and trust among all participants. 

Cybersecurity in healthcare poses unique challenges. Our shared national goals for 
interoperation require secure connections to health organizations nationwide - whether 
it is a sophisticated health system with access to resources or a small physician practice 
that may not have the expertise or resources to implement security best practices. At 
the same time, the FBI estimates that the average cost of even a partial electronic 
health record on the black market is approximately $50 compared to $1 for a stolen 
social security number or credit card number. EHR data can be used to file fraudulent 
insurance claims, obtain prescription medication, and advance identity theft. EHR theft 
is also more difficult to detect, taking almost twice as long as normal identity theft. 

Given this situation, cyber attacks on healthcare organizations are potentially lucrative, 
and will not diminish in the near future. 
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HLC has supported bipartisan congressional efforts to protect health organizations from 
serious and evolving cybersecurity threats. We have supported efforts that promote 
voluntary, cyber threat information sharing between government and health care 
organizations as long as liability and anti-trust protection is guaranteed for organizations 
that have agreed to share information and protect their systems. 

We strongly support a collaborative approach to ensuring health information security. 
Health organizations that are threatened by malicious external attacks need a trusted 
partner in the federal government that will support and help to protect them. It is critical 
that the electronic systems supporting our healthcare providers be protected. These 
systems are a relied upon component in our nation’s first response to major crises, and 
are necessary to provide critical care to those most in need. 

Thank you for the opportunity to provide this written testimony before the committee. 

For further information, please have your staff contact Tina Olson Grande, Senior Vice 
President for Policy, at the Healthcare Leadership Council f tarande@hlc.ora L 
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Appendix 1 : Telehealth Legislation Supported bv HLC 

/n the 1 14^ Congress, HLC has supported two bills that would expand access to 
telehealth. 

1) The CONNECT for Health Act {S.2484 / H.R.4442), introduced by Senators 
Schatz (D-HI), Wicker (R-MS), Cochran (R-MS), Cardin (D-MD), Thune (R-SD), 
and Warner and Representatives Black (R-TN), Harper (R-MS), Welch (D-VT), 
and Thompson (D-CA), would promote cost savings and quality care in Medicare 
through telehealth and remote patient monitoring. Over 50 organizations 
spanning all sectors of healthcare including plans and providers as well as 
physician groups, patient organizations, academic centers, and many others 
support this legislation. 

The CONNECT for Health Act would: 

• , Create a bridge program to help providers transition to the goals of the 

Medicare Access and CHIP Reauthorization Act (MACRA) and the Merit- 
based Incentive Payment System (MIPS) through using telehealth and 
remote patient monitoring (RPM) without most of the current regulatory 
restrictions that limit the use of telehealth based on type of services 
provided, geographic location, the type of clinical site the patient is located 
in, type of institution delivering the services, and type of health provider 
(“1834(m) restrictions”). 

• Allow telehealth and RPM to be used by qualifying participants in 
alternative payment models, without most of the aforementioned 1834(m) 
restrictions; 

• Permit the use of remote patient monitoring for certain patients with 
chronic conditions; 

• Allow, as originating sites, telestroke evaluation and management sites; 
Native American health service facilities; and dialysis facilities for home 
dialysis patients in certain cases; 

• Permit further telehealth and RPM in community health centers and rural 
health clinics; 

• Allow telehealth and RPM to be basic benefits in Medicare Advantage, 
without most of the aforementioned 1834(m) restrictions; and 

• Clarify that the provision of telehealth or RPM technologies made under 
Medicare by a health care provider for the purpose of furnishing these 
services shall not be considered “remuneration.” 

The bill includes requirements regarding cost containment, quality measures, 

and data collection. An Avalere analysis of three of the major provisions of 


16 



63 


the bill (first three bullets above) showed $1 .8 billion in savings over 10 years, 
with savings resulting from reduced hospitalizations due to the use of RPM. 
The analysis estimates that in Fiscal Year 2017, a total of 14.7 million 
Medicare beneficiaries will be using telehealth services and 3.3 million 
beneficiaries will be using RPM. 

2) The TELEmedicine for MEDicare (TELE-MED) Act (H.R. 3081/S. 1 778), 

introduced by Representatives Nunes (R-CA) and Pallone (D-NJ) and Senators 
Hirono (D-HI) and Ernst (R-IA), would improve access to providers across state 
lines. 

This bipartisan legislation allows Medicare providers to treat patients 
electronically across state lines without having to obtain multiple state medical 
licenses. The bill also includes provisions that would direct the HHS Secretary to 
issue guidance to states to develop a definition of “telemedicine services” using 
input from relevant stakeholders including patients, health care providers, State 
government officials, health technology developers, insurers, employers, 
licensing boards, community health organizations, and other Federal agencies 

This bill would allow for expanded access to care, improved patient outcomes, 
and lower healthcare costs. Medicare beneficiaries are often not able to travel to 
receive care due to distance health, transportation, financial, or mobility issues, 
and provider shortages (particularly in certain specialties) may make it even more 
difficult to access necessary care. These access challenges increase beneficiary 
and system healthcare costs overall by making it difficult for patients to obtain the 
best care and treatment at the right time. 
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Execuiiv.- Summary 

There is a broad consensus in the United States amcmg healthcare providers, payers, clinicians, patients, 
and consumers that the nation's healthcare syst«n do^ not operate at a level that generates optimal value. 
There is significant room for improvement in elevating quality, cost-efficiency, and sustainability. There 
is a gap between the innovations being developed in all s^ois of healthcare and the ability to deliver 
those improved products and practices to paticmts. 

While the Affordable Care Act focused on extending health coverage to tens of millions of Americans, a 
comparable effort is needed to address the health S 5 ^tan's continuing cost, quality, and value challenges. 

Through the Healthcare Leadership Council's National Dialogue for Healthcare Innovation (NDHI) 
initiative, companies fi'om all sectors of healthcare joined with leaders of patient advocacy organizations, 
federal government officials, and academic health |X)Iicy experts to build consensus on a broad spectrum 
of steps necessary to strengthen health system value and enable health innovation to have a greater 
positive impact on the entirety of the healthcare continuum. 

NDHI participants came to the conclusion that healthcare in the U.S. can be significantly improved by 
focusing on actions that are readily achievable via legislation, regulation, or voluntary actions by various 
health system players. Positive health system transformation does not require a wholesale remaking of 
health delivery structures, but rather the enabling and acceleration of patient-centered innovation. 

The diverse companies, organizations, and policy experts participating in the NDHI process agreed that 
focused actions in the following areas can significantly elevate health system value: 

n Comprehensive care planning 
« Medication therapy management 
s Health infomiation interoperability 

m Changes to federal anti-kickback and physician self-referral (Stark) laws 
m Health information flow improvements focused on patient privacy laws and regulations 
m Food and Drug Administration (FDA) reforms 

In these areas, there is consensus that the following actions should take place: 

Comprehensive Care Planning 

Today, over 80% of older adults have at least one chronic condition such as diabetes, congestive heart 
failure or hypertension, and one of every two seniors have at least two of these illnesses. The need for 
coordinated care for these individuals is clear. Yet, integrated, comprehensive care has been lacking. 

This fragmentation can lead to a myriad of difficulties such as lack of patient adherence. For decades, 
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significant numbers of patients have failed to take the medications prescribed by healthcare professionals. 
Studies have shown that, on average, 50% of medications for chronic disease are not taken as prescribed. 
This non-adherence problem may be costing the healdicare system as much as S300 billion annually. 
Improved care coordination and adherence can have a dramatic effect on population health while 
significantly reducing health system costs. 

In evaluating the most effective mechanisms to address the care coordination challenge, NDHl 
participants focused on diabetes - a disease with rapidly growing incidence rates and a patient population 
with consistently poor care coordination and adherence practices. Current Medicare reimbursement 
practices exacerbate this problem by, among other flaws, not paying for care coordination or coaching for 
diabetes management (including remote services), not reimbursing for participating in National Diabetes 
Prevention Programs, and not recognizing continuous glucose monitoring as a covered benefit. 

NDHI participants believe there are three principles that should inform comprehensive care plans and 
serv'e as the rationale for government reimbursement of care activities. They are: 

m Comprehensive care planning must address the population 's multiple co-morbidities and complex 
care needs. This principle addresses the fragmentation of the health delivery system for people with 
diabetes (and other chronic illnesses). Team-based care should be viewed as essential in care 
planning. 

m Chronic disease programs must address these illnesses across the entire continuum of care. Care 
planning must promote not only screening and identification of risk factors for patients all along the 
disease spectrum, but also focus on hospital-to-home care transitions for chronic disease patients. 
m Comprehensive care planning must be cognizant of issues related to the individual and community- 

level context Care plans must equip patients with tools they need to successfully manage their 
conditions and proactively address the challenge of inadequate health literacy in the patient 
population as well as specific cultural beliefs about health. 

Medication Therapy Management 

Misaligned incentives have prevented the medication therapy management (MTM) program, part of the 
Medicare Part D prescription drug program, from achieving significant benefits. In September 2015, the 
Centers for Medicare & Medicaid Services (CMS) announced its intent to form a Part D Enhanced MTM 
Model to better align prescription drug plan sponsor and government financial interests while creating 
incentives for robust investment and innovation in better MTM targeting and interventions. 

There are many ways this Enhanced MTM Model should be optimized to achieve greater levels of patient 
adherence and, thus, improved health outcomes. These include: 

® An accelerated implementation of the Enhanced MTM Model. As it currently stands, the model does 
not start until 201 1, will run for five years and then be evaluated. This means a potential delay of 
seven to 10 years before the model s benefits can be extended to all Medicare beneficiaries. 
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m The design should he expanded to offer benefits to all Part D members, including those in Medicare 
Advantage plans, to better align the financial interests of government and prescription drug plan 
sponsors. 

® CMS should provide participating plans an opportunity to participate in developing quality 

measures, measures that should be formed through an intensive, transparent development and 
e\>aluation process. 

® CMS should conduct robust education of providers and pharmacies on the Enhanced MTM model to 
better achieve optimal therapeutic outcomes. 

M CMS should reconsider its stance regarding collaboration between pharmaceutical manufacturers 
and health plans. Such collaboration can encourage appropriate interactions that will result in 
improved medication adherence. 

Health information Interoperability 

Achieving high-value care requires a system that provides relevant health data to the right individuals at 
the right time. Comprehensive, readily accessible data is essential for both individual care decisions and 
population health management. A 2015 report by the Bipartisan Policy Center noted that billions of 
dollars are being invested in new healthcare delivery and payment systems that will reward better costs 
and quality outcomes, but that these arrangements will only be successful if greater information sharing 
and interoperable systems are in place. 

Progress in this area had been lagging. As of 201 3, only 62% of hospitals had reported being able to 
exchange electronic health information with any provider outside their organization; but recently the 
private sector has been driving improvements at a rapid pace. In fact, over the past 18 months the private 
sector has demonstrated through efforts such as the CommonWell Health Alliance, the Sequoia Project, 
and the Argonaut Project, among others, that there is a will to make progress toward interoperability 
through innovative efforts that are not driven solely by government regulation. The participants of NDHI 
believe that the private sector should continue to lead this progress with a limited role for government. 
Appropriate government involvement could include a governance structure that defines the “rules of the 
road,” such as prohibiting infomiation blocking through certification authority or requiring a basic set of 
standards that the private sector could innovate from (such as open, publicly-available application 
program interfaces or APIs). Importantly, the participants of NDHI agree that any interoperability 
incentives from the federal government should be “technology neutral” and focused on outcomes in order 
to promote accessible and rapid irmovation in health information connectivity. 

NDHI participants identified challenges to achieving full-system interoperability, including conflicting 
and competing standards, the need for dissemination of emerging best practices in patient identification 
and matching, the lack of consensus on clinical workflow and payment reform best practices, and the 
complex provider collaborations involved in new delivery and payment models. 
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All of the companies and organizations involved in the NDHI initiative support the establishment of a 
December 3 1 , 2018 deadline for health information interoperability, on or before which the nation must 
achieve nationwide exchange of health information through interoperable certified electronic health 
records (EHR) technologies. According to NDHI pmticipants, this date of December 3 1 , 20 1 8 is 
achievable if driven by the private sector and the parameters and barriers noted above are sufficiently 
addressed. 

Consumers should also have easy and secure access to their electronic health infonnation, be able to 
direct it to any desired location, learn how their information can be shared and used, and be assured that 
this information will be effectively and safely used to benefit their health and that of their community. 

Federal Anti-Kickback and Physician Self-Referral (Stark) Laws 

To achieve improved care quality and cost containment, new healthcare delivery and payment models are 
designed to encourage greater integration among providers and other healthcare stakeholders. This raises 
the need to address the current federal fraud and abuse legal frmnework to make it more compatible with 
value-focused, integration-oriented health system transformation. 

NDHI participants have focused on two of the primary fraud and abuse laws ~ the Federal Anti-Kickback 
Statute and Physician Self-Referral (Stark) Law - and prioritized both regulatory and legislative options 
that should be pursued, independently or concurrently, to better support innovative payment and delivery 
reforms. 

The regulatory options include: 

e Create Federal Anti-Kickback Statute and Stark Law waivers for all Accountable Care Organizations 
that meet certain conditions. 

B Extend existing Anti-Kickback and Stark Law exceptions for donation and financial support of EHR 
software, and related interoperability-enabling technologies and training beyond 2021. 
m Clarify how to establish, document and apply the “volume or value of referrals ” standard within the 
changing healthcare payment environment. 

8E Expand and revise the definition of fair market value to account for new payment models that 
incentivize performance. 

m. Eliminate the “one-purpose ” test for Anti-Kickback Statute liability and replace with a balancing test 
that would require the HHS Office of Inspector General (OIG) to prove either increased costs or 
actual harm to patients. 

m When considering potential regulatory changes to the Federal Anti-Kickback Statute, stakeholders 
should also consider related changes to the Civil Monetary Penalties (CMP) Law, where 
appropriate, to ensure consistency in interpretation and application across both laws to encourage 
patient engagement and improved outcomes. 
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The legislative options include: 

® Require the Department of Health and Human Sendees Secretary to review and assess the Federal 
Anti-Kickback Statute and Stark Law as well as the Civil Monetary Penalties (CMP) Law (expansion 
of current MACRA requirements) in the context of health system transformation, specifically 
addressing whether the laws create unnecessary barriers to new integrated care models and whether 
these law^s are effective in limiting fraudulent behavior. Changes identified through this assessment 
may yield opportunities to amend fraud and abuse laws to foster healthcare arrangements that 
promote increased quality and lower costs. 

s Grant OIG and CMS broader flexibility and discretion to develop exceptions and safe harbors to the 
Federal Anti-Kickback Statute and the Stark Law consistent with current health policy’ objectives 
(e.g., increased efficiency and quality, decreased cost). 

Health information Flow Improvements 

As healthcare systems make the transition to value-based care, accessibility and use of data takes on an 
exponentially greater importance. Unnecessary barriers to data sharing may impede a physician’s ability 
to accurately diagnose patients and prescribe the most effective treatments, can lead to workflow 
inefficiencies, and potential inaccuracies in matching records with the correct patient. 

At the same time, in today’s environment, it is essential that patients be assured that their personal health 
data is protected and only accessed by those with legitimate and essential reasons to view it. Today, 
inconsistent interpretations of federal privacy laws as well as varying state privacy laws are leading to 
confusion and, with it, counterproductive restrictions on the necessary movement and sharing of health 
data. 

NDHI participants have the consensus view that there is a need for a national health privacy standard to 
mitigate problems deriving from the variation among state laws and regulations. There is also a need for 
updated and harmonized federal privacy rules to align with new and innovative healthcare research 
capabilities. All privacy structures must enable the matching of records to the right patients with minimal 
time and effort. 

FDA Reforms ^ 

Today, there are unnecessary delays in bringing new, improved treatments and technologies to patients 
due to redundant and counter-productive regulations from the FDA. Encouraging policy changes that 
streamline the agency’s responsibilities, while ensuring that manufacturers remain accountable, could 
enable FDA to focus on high-priority activities and speed the approval of new medicines and healthcare 
products. NDHI participants also identified a series of unnecessary and redundant regulations that, if 
addressed, can accelerate patient access to new innovations. These include: 
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m Eliminate the prohibition on using a single Institution Review Board of record for medical de\>ice 
trials, reducing the cost and time involved in product approvals, 
m Allow companies to make certain changes to devices without a premarket submission, as long as the 
companies ’ quality systems have been certified as capable of evaluating such changes. 
s Timelier recognition of standards established by international or nationally-recognized standards 
organizations. This will improve regulatory efficiency and reduce the time to bring medical 
technology to patients. 

s Expand the definition of valid scientific evidence to include evidence described in well-documented 
case histories, including registry data, studies published in peer-reviewed journals and data collected 
outside the U.S. 

m Provide greater training and achieve improved understanding of the use of ‘least burdensome 
provisions ' to increase efficiency and consistency for the FDA and manufacturers, 
m Increase the flexibility for biopharmaceutical manufacturers, payers and providers to share scientific 
and healthcare economic information in order to optimize the clinical benefits of prescribed 
treatments. This type of information is critical for developing value-based payment systems. 


Each of these recommended steps, implemented individually, will strengthen healthcare quality and 
improve cost-efficiency. Adopted collectively, they can usher in a new era of healthcare reform, one that 
will make our health systems more value-focused and financially sustainable while bringing about an 
unprecedented level of improved population health through greater access to innovative cures, treatments, 
and medical technologies. 
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introcu'i'-iion 


In 2010, the Healthcare Leadership Council (HLC), a coalition of chief executives from all sectors of 
healthcare - payers, providers, manufacturers, distributors, pharmacies, health information technology 
firms, and more - created the National Dialogue for Healthcare Innovation (NDHI). The purpose of 
NDHI is to create a platform through which these various health industry sectors can collaborate with 
patients, employers, academicians, and gov«mment to examine, discuss, and build consensus on how to 
address the most important issues affecting the cour^ of 21®* century healthcare progress. 

On March 2, 2015, under the auspices of NDHI, an unprecedented summit meeting took place in 
Washington, D.C. Leaders of more than 70 of the most influential organizations in healthcare - including 
high-ranking officials from the Department of Health and Human Services (HHS), the Centers for 
Medicare & Medicaid Sendees (CMS) and the Food and Drug Administration (FDA) - convened to 
identify the barriers impeding progress toward a high-value, innovation-driven healthcare system, and 
how to remove those barriers. This was a rare meeting focused not on a single, narrow healthcare issue, 
but rather on how to create a sustainable system equipped to address persistent cost and quality 
challenges. 

As FILC President, Mary R. Grealy said at the March 2 summit, “There are a lot of voices out there 
talking about healthcare costs, value, affordability, and sustainability. WeTe never going to develop a 
pathway, though, that will incentivize innovation and strengthen health system value until we bring 
everyone to the same table.” 

Once leaders from across the healthcare spectrum came to the NDHI table, they decided to continue 
working to develop consensus solutions aimed at achieving greater healthcare quality and cost-efficiency. 
Following the summit, NDHI participants established three workgroups focusing on (1) Patient 
Engagement and Adherence, (2) Data Strategy and Electronic Health Records Interoperability, and (3) 
Outdated and/or Ineffective Laws and Regulations. 

The workgroups collaborated throughout 2015 to agree upon policy approaches that transcend the 
theoretical and are viewed as clearly achievable, whether through legislation, regulatory action, or 
proactive steps initiated by healthcare organizations. 

What emerged from this process is a blueprint that will be offered to executive and legislative branch 
policymakers and healthcare leaders. The recommendations in this paper, taken in total, can drive health 
system transformation and a movement toward value and innovation. The consensus viewpoints 
contained in this report are also consistent with ste]^ currently being taken by the federal government to 
guide a health system transition from fee-for-service to pay-for-value and toward more integrated, 
coordinated care. 
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Drivers of Increased Value and Innovation 
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Seldom have such diverse interests and perspectives reached a shared view on how to advance value and 
innovation within the healthcare system. These recommendations can serve as a catalyst for further 
debate and, optimally, decisive action. 
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Appro.'i' hes to Accelerating Healthcare Innovatio;'. 

Addressing Three Key Areas 

The following sections describe key findings from NDHI, which cover three key topic areas: 
a Patient Engagement and Adherence; 

® Data Strategy and Electronic Health Records Interoperability; and 
s Outdated and/or Ineffective Laws and Regulations 

Each section pro\4des a framing of the salient issues, potential strategies for addressing these issues, and 
recommendations to elevate health system value. 

Patient Engagement and Adherence 

Patient-centered care is the key to value-driven, quality healthcare. By asserting more responsibility in 
healthcare planning and decision making, the consumer 
can drive change throughout the healthcare system. 

Likewise, without an engaged healthcare consumer, it is 
difficult for health organizations to drive patient-centered, 
coordinated quality care. 

One key component of value driven care is patient 
engagement and adherence. Patient non-adherence can 
take many forms. These can include the failure to keep 
appointments, to follow recommended dietary or other 
lifestyle changes, or to follow other aspects of treatment 
or recommended preventive health practices. Medication 
non-adherence is a particularly complex and growing public health concern to clinicians, healthcare 
systems, and other stakeholders^. The lack of adherence to a prescribed treatment regimen is associated 
with poorer patient outcomes, including unnecessary disease progression, reduced quality of life, and 
even premature death. It also creates a significant societal burden, including increasing healthcare costs 
from hospitalizations and invasive procedures to address complications that may have been prevented 
with continuous intervention. 

Reasons for non-adherence are multifactorial and difficult to identify. Patient therapeutic compliance 
may be associated with certain types of diseases, for example. E\ddence shows that non-compliance is 
less common in acute illness or illness of short duration. In contrast, patients who are suffering from 
chronic diseases, in particular those with fluctuation or absence of symptoms are more likely to be non- 
compiiant. 


Medication adherence and coniphcinor* aio 
synonymous terms, w'ulti mediuation 
persistence is n rnintnd but di'itinct tern 

« Cony>{fanc& (or its synonym adheronco): 'the 
act of conforming to the recomniendattons 
2 made by tiie provider with respect to tming. 
dosage, and frequency of madicstion taking. 

'■ Therefore presenpbon medication compliance 
may be defined as ‘the extent to which a 
patient acts in accordance with the prescribed 
interval and dose of a dosing regimen.' 

. . Compliance is measured over a period of time 
! ^|! and reported as a percentage. . . ” 

! « Pers/sfenee: *the duration of time from 
'• inifaation to dlsconti.nuation of therapy"' 
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While the issue of patient adherence has be«i 
extensively researched, the rates of non-adherence have 
not shown significant improvement in the past three 
decades. 

Today, about 80% of older adults have at least one 
chronic condition, and 50% have at least two. Diabetes, 
congestive heart failure, and hypertension repres^t 
three of the top five most prevalent conditions among 
Medicare beneficiaries."’ Given that many chronic 
diseases can be treated and managed through behavior change and medication, this is a ripe area for 
action to promote patient adlierence. 


Scope of tile Medication Adherence Issue 

“Studies have shown that 20 to 30 percent of 
medication prescriptions are never filled and that, on 
average, 50 percent of medications for chronic disease 
are not taken as prescribed. This lack of adherence to 
medications is not only prevalent but aiso has dramatic 
effects on individual- and population-level health. Non- 
adherence has been estimated to cost the U.S. 
healthcare system between $100 billion and $289 
billion annually in direct costs. Strong evidence 
suggests that benefits attributable to improved self- 
management of chronic diseases could result in a 
cost-to-savings ratio of approximately 1:10.”'" 


I’o address the complex issues described above, NDHI participants selected two key policy areas for 
further exploration: 

1 . Comprehensive Care Planning Principles (with diabetes as a case study); and 

2. Medication Therapy Management (MTM) Models 

The NDHI sought to identify specific opportunities to improve patient adherence through: (a) improving 
adherence along the continuum of care via the development of common principles that should be 
incorporated into any care plan for patients with diabetes; and (b) reforming federal Ml'M programs by 
reviewing and making recommendations for streamlining and''or improving these programs. Addressing 
these issues supports NDHTs overarching objective of enhancing value in healthcare by using innovative 
therapies, policies, and practices to support improved patient adherence that maximizes quality outcomes. 


The next section describes the Comprehensive Care Planning Principles for diabetes in detail. 


Comprehensive Care Planning Principles: Diabetes 

Background 

Definitions and Policy Context 

The concq?t of comprehensive care planning is patient-centered, participatory, and nested within the 
broader concept of care coordination for people living with chronic illnesses.’^ 

CMS offers a basic definition of a care plan: “A written plan for your care. It tells what services you will 
get to reach and keep your best physical, mental, and social wellbeing.’”^ CMS also provides an 
operational definition of a care plan that is more detailed and relevant for addressing the complexities 
facing patients who live with chronic illnesses: “It typically includes but is not limited to the following 
elements: problem list, expected outcome and prognosis, measurable treatment goals, symptom 
management, planned interventions, medication management, community and social savices ordered, 
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direction and coordination of the services of agencies and specialists unconnected to the practice, 
identification of the individuals responsible for each intervention, requirements for periodic review, and, 
when applicable, any revisions.”''" The issue of comprehensive care planning is receiving considerable 
attention among policymakers. For example, The Improving Medicare Post-Acute Care Transformation 
(IMPACT) Act of 2014,''"* which mandates common patient assessment data and quality measure 
reporting requirements for post-acute care (PAC) provides, also establishes new discharge requirements 
for general acute-care, critical access hospitals, and post-acute providers that are intended to facilitate the 
flow of patient information to the next healthcare setting. Beginning in late 2016, CMS will require long- 
term care facilities to develop a care plan for each resident within 48 hours of admission.** CMS also 
proposes to require long-term care facilities to document in a beneficiary's care plan their goals for 
admission, assess the potential for future discharge, and include discharge planning in the comprehensive 
care plan for the beneficiary. The agency also proposes to add to the post-discharge plan of care a 
summary of arrangements for a beneficiary's follow-up care and post-discharge services, and the 
discharge summary must include a reconciliation of a beneficiary's current medications with those that the 
beneficiary was taking before entering the facility. Additionally, the Care Planning Act of 2015 (S. 

1549) is pending legislation that would help severely ill patients (e.g., patients with late-stage diabetes) 
improve care coordination through patient-centered care planning - via the establishment of “planning 
services” as a Medicare benefit. Separately, the Government Accountability Office (GAO) recently 
released a report noting that under the Patient Protection and Affordable Care Act (ACA), there remain 
concerns that low-income individuals transitioning from Medicaid to exchange coverage may experience 
coverage gaps, due to the complex nature of coordinating policies and procedures.* Furthermore, the U.S. 
Senate Committee on Finance announced in May 2015 the formation of a Chronic Care Working Group 
that aims to improve care coordination and ensure high quality care for people living with chronic 
illnesses; notably, the Committee will place a strong emphasis on care coordination.*' 

There are a myriad of types of patient non-adherence (i.e., non-adherence related to medication, lifestyle, 
or exercise guidance from health providers), and the reasons for patient non-adherence are complex as 
well.*“ For example, a 2009 systematic review by RAND*'” found four major types of barriers to 
medication adherence; 

a cost-sharing 

regimen complexity 
m medication beliefs 
^ depression (in patients with diabetes)*''' 

(However, it is important to note that much of this research predates the passage of the ACA, which has 
improved coverage to many individuals who were previously uninsured or underinsured.) 

In response to concerns about patient adherence, CMS recently announced the Medicare Part D Enhanced 
MTM Model,*'' which will place an emphasis on “ri^t sizing” MTM and testing innovative regulatory 
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flexibility and payment incentives to target high-risk beneficiaries and provide them with the appropriate 
level and intensity of services. 

Maximizing the potential for coverage of therapies and care management and assuring that all payers, 
providers, and patients recognize the value of patient adherence is key to the long term solution to this 
complex issue. 

The Need to Focus on Diabetes 

The NDHI developed a set of policy principles on comprehensive care planning for patients living with 
chronic diseases, using diabetes as a case example. These principles will inform future efforts to proride 
legislators and policymakers with evidence-based recommendations for addressing the complex needs of 
people with diabetes - as well as other chronic diseases. Diabetes is an important test case for 
comprehensive care planning because of its complexity as well as prevalence in the United States (U.S.). 
Althou^ diabetes is a well-understood disease, individual patients may encounter many different 
obstacles that would prevent them from reaching optimal health. These barriers range from 
socioeconomic factors or lack of diabetes management education to the competing demands of family 
responsibilities and dynamics.^'* Cost of care may also be a barrier to good adherence. 

The American Diabetes Association (ADA) cites compelling national statistics in its Standards of 
Medical Care in Diabetes — 2015 reporf"'" that underscore the need for effective disease management 
interventions; “[Bjetween 33 and 49% of patients [with diabetes] still do not meet targets for glycemic, 
blood pressure, or cholesterol control, and only 14% meet targets for all three measures and nonsmoking 
status.” Furthermore, diabetes, along with congestive heart failure (CHF) and hypertension, rq>resent 
three of the top five most prevalent conditions among Medicare beneficiaries. These conditions share 
many of the same common, modifiable risk factors and comorbidities, including obesity and physical 
inactivity. 

Finally, diabetes presents opportunities to intervene at multiple stages of the disease continuum, 'fhose at 
high risk for diabetes, even if they are asymptomatic, should be screened consistent with screening 
guidelines (The U.S. Preventive Services Task Force (USPSTF) recommends screening as part of 
cardiovascular risk assessment in adults aged 40 to 70 years who are overweight or obese.*'"’) so that the 
disease does not progress unchecked before diagnosis. Even those diagnosed with prediabetes, a 
condition where blood sugar is higher than normal but not high enough to be diagnosed as diabetes,*'* can 
take steps to delay or prevent progression to Type 2 diabetes. 

Diabetes Care Challenges 

In spite of the tremendous loll of diabetes, numerous challenges for reimbursement of diabetes-related 
care hamper efforts to improve patient health: 
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■ Currently in fee-for-service Medicare, CMS provides little or no reimbursement for remote care, care 
coordination, or coaching (e.g., phone visits, follow-up text messages, online) for the care and 
management of diabetes. 

* Certified Diabetes Educators (CDEs) are not statutorily recognized providers of Diabetes Self- 
Management Training (DSMT) services, including DSMT by telehealth, under Medicare Part B. 
Additionally, diabetes case managers and educators receive differential reimbursement and medical 
nutrition therapy (MNT) and DSMT providers are not reimbursable on the same day. 

» The new care coordination Healthcare Common Procedure Coding System (HCPCS) G-code has not 
been interpreted to include remote care coordination or coaching. Beyond basic evaluation and 
management services, few other avenues exist to compensate diabetes care providers for the intensive 
time and effort necessary to provide comprehensive management and support to patients with 
diabetes. This patchwork of regulation and reimbursement creates unnecessary gaps in patient care 
and makes healthcare more expensive overall. 

5 For patients with prediabetes, Medicare does not reimburse for participation in National Diabetes 
Prevention Programs (DPP, a lifestyle change program that can help prevent or delay the onset of 
type 2 diabetes) or MNT for people at high risk for developing diabetes. 

In addition to undermining provider support, the current reimbursement structure makes it difficult for 
patients with diabetes to monitor the disease themselves. Medicare does not cover the tools and devices 
that some individuals need to most effectively monitor their diabetes: 

•> Medicare does not recognize continuous glucose monitoring (CGM) as a covered benefit. In 
numerous clinical trials, CGM systems have demonstrated improvement in overall glucose control 
and reductions in dangerous episodes of hypoglycemia when compared to self-monitoring of blood 
glucose (SMBG). Since CGM technology is covered widely outside of Medicare, beneficiaries 
entering Medicare may be forced to give up the diabetes blood glucose monitoring system that they 
had become accustomed to using with another payer. 

• The 20 1 3 competitive bidding program limits choices and access to certain types of diabetes testing 
supplies, such as blood glucose testing strips, purchased through mail order. If beneficiaries have 
difficulty finding replacements for familiar products, they may be inappropriately influenced to 
switch test systems. Product switching can have negative health and economic consequences.” 

Additional challenges include patient adherence for individuals with hypoglycemia, or abnormally low 
blood glucose levels. Hypoglycemia is the largest single barrier to achieving glycemic control in type 1 
and type 2 diabetes™ and is a significant cause of emergency department visits and hospitalizations, 
which increases the cost of treatment. Consideration of education and alternate therapies for individuals 
who experience hypoglycemia may help to alleviate the incidence of hypoglycemia. 

Another care management challenge to consider in effective diabetes management are cases of clinical 
inertia - inadequate intensification of therapy by the provider. For example, newly diagnosed patients 
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often stay on a specific oral medication alone for about 14 months without additional agents (e.g., insulin) 
being added, even though they have not met their AlC goal. 

Greater alignment between reimbursement stiuctures and appropriate care steps could also lead to better 
outcomes for both patients and payers. At the healthcare system level, physicians of patients with 
multiple providers are not incentivized to work as a team, which creates challenges for persons with 
diabetes receiving coordinated, consistent care across numerous encounters. A 2014 RAND study of 
nearly 300,000 Medicare recipients”'" found that individuals with better continuity of care were less likely 
to be hospitalized, less likely to visit hospital emergency departments, had lower rates of complications, 
and had lower overall costs for their episodes of care. 

Diabetes management also faces hurdles in the area of reporting and quality. There is a lack of unifonn 
quality metrics across government programs, coupled with limited diabetes quality measures and 
alignment across Medicare Part A, B, and D. Payment is not currently tied to meeting appropriate 
standards of care for all services delivered. These gaps do not incentivize comprehensive diabetes care 
and make it harder for quality to be assessed and for providers and payers to monitor and respond to data. 

Finally, quality diabetes care is often impeded by cost — both to the system and to patients. Every effort 
should be made to design diabetes care protocols that address this barrier. For example, the provision of 
additional tools for the patient or the provider or the promulgation of value-based benefit design could 
help address this issue. Additionally, it is crucial to recognize that the enormous prevalence of diabetes 
has significant consequences for health system stability as a whole, and efforts must be made to make 
investments in quality care that focuses on halting or slowing disease progression and the onset of 
complications. 

Comprehensive Care Planning Principles 

Below, we describe three Care Planning Principles for diabetes, along with key components/practices that 
should be included in comprehensive care plans and rationale for government reimbursement of these 
activities. These components can also inform the promulgation of quality measures related to 
comprehensive care plans for diabetes. These principles support NDHTs twin objectives of enhancing 
value in healthcare by using innovative therapies, policies, and practices to support improved patient 
adherence that maximizes quality outcomes. 


These principles closely align with the ADA’s Standards of Medical Care in Diabetes — 20?5/”" which provide four 
core recommendations for improving diabetes care, overall: 

1. A patient-centered communication style that incorporates patient preferences, assesses literacy and 
numeracy, and addresses cultural barriers to care should be used. 

2 . Treatment decisions should be timely and founded on evidence-based guidelines that are tailored to 
individual patient preferences, prognose, and comoihidities. 

3. Care should be aligned with components of the Chronic Care Model (CCM) to ensure productive 
interactions between a prepared proactive practice team and an informed activated patient. 

4. When feasible, care systems should support team-based care, community involvement, patient registries, 
and decision support tools to meet patient needs.”®’' 


REPORT! 8 
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Principle I: Comprehensive care planning must address the population ’s multiple co-morbidities and 
complex care needs. 

Comprehensive, patient-centered care planning must address a key underlying health system issue: the 
fragmentation of the health delivery system for people with diabetes. The notion of “team-based care” is 
one that should be championed as part of care planning. 

Component 1.1 : Care plans should incorporate evidence-based care coordination strategies (defined by 
the Agency for Healthcare Research and Quality’s (AHRQ’s) as “deliberately organizing patient care 
activities and sharing information among all of the participants concerned with a patient’s care to achieve 
safer and more effective care”^^') that address underlying patient comorbidities (e.g., depression). The 
ADA suggests that addressing missed treatment goals may require evaluation of barriers such as diabetes- 
related distress or depression and the American Association of Clinical Endocrinologists and 
American College of Endocrinology’s evidence-based clinical practice guidelines for diabetes makes the 
following recommendation for patients with diabetes and depression: “Patients with depression or 
[diabetesj-related distress should be referred to mental health professionals who are integrated into the 
[diabetes] care team.”’“''“ For example, Katon and colleagues conducted a trial of “collaborative care” in 
14 clinics in the state of Washington, in which nurses provided “guideline-based, patient-centered 
management of depression and chronic disease.” The researchers found significant 12-month 
improvements along a number of measures related to both diabetes and depression (e.g., glycated 
hemoglobin, patient satisfaction, and perceived quality of life) due to the intervention.^’^'""' 

Comprehensive care plans, by definition, should address the full range of health problems of a particular 
patient - i.e., not limited to diabetes. For example, diabetes care plans should explicitly address 
comorbidities such as cardiovascular disease. The American Heart Association recognizes a strong 
correlation between cardiovascular disease (CVD) and diabetes. Heart disease and stroke are the number 
one causes of death and disability among people with type 2 diabetes and adults with diabetes are two to 
four times more likely to have heart disease or a stroke than adults without diabetes.”^’^ In this regard, the 
ADA notes the need for “a comprehensive plan to reduce cardiovascular risk by addressing blood 
pressure and lipid control, smoking cessation, weight management, and healthy lifestyle changes that 
include adequate physical activity” for patients with diabetes."* 

Component 1.2 : Comprehensive care planning should include the use of care coordinators to address the 
multitude of daily issues facing persons with diabetes. For example, the use of care coordination 
programs may have potential for managing care transitions and obviating hospital readmissions. Care 
planning for people living with diabetes ne«ls to include interdisciplinary teams that can meet the holistic 
needs of individuals and engage community resources outside the hospital sector. 

Care coordinators can be deployed to provide a variety of services, including: assessing treatment 
adherence, coordinating with providere about patient treatment needs, ensuring that patients have 
transportation, language translation, and other support services needed to access care, and providing 
health education. An increasingly multidisciplinary approach to the care of these patients may be one 
answer for improving patient clinical outcomes and healthcare resource utilization. Community health 
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workers or other non-iicensed health provider can also provide critical care coordination services and 
should be considered a vital part of the care team. 

Component 1.3: Comprehensive care planning should be supported by improved communication and data 
sharing among providers on the interdisciplinary diabetes care team. For example, the National Diabetes 
Education Program cites the importance of timely information-sharing via the use of health infonnation 
systems by care teams, which comprise “the primary care provider, endocrinologist, nurse, diabetes 
educator, dietitian, mental health provider, exercise physiologist, other team members and specialists, as 
well as hospital-based providers.’”^*’ The contributions of non-licensed, community-based health 
providers should also be integrated into electronic medical record systems so that records reflect the 
entirety of patient treatment. 

One strategy for achieving communication and data sharing is the increased use of telehealth. While the 
scientific literature is still emerging on the full benefits of telehealth applications, promising initiatives 
have been described. For example, a recent randomized clinical trial of a telehealth remote monitoring 
intervention, in which patients remotely sent their paired glucose tests (i.e., before and after a meal or 
physical activity) via tablet and subsequently received feedback from certified diabetes educators, led to 
improvements in AlC levels.'^’*" Also, the DiaTel randomized, controlled trial of active care management 
supplemented by home telemonitoring inter\'ention, demonstrated long-term (> 6 months) reductions in 
AlC levels in a population of veterans.*^' 

The use of patient-centered health information technologies for diabetes is one way to ensure 
communication between patients and providers in care planning and empower patients to express their 
values, needs, and preferences about their care. Patient adherence can often be improved either through 
personalized care coordination or through simpler systems of reminders and educational materials. 
Greater data connectivity can also be used to identify gaps in diabetes care for other important treatment 
indicators, such as blood glucose monitoring. 

For example, remote patient monitoring (RPM) technology enables monitoring of patients outside of 
conventional clinical settings (e.g., in the home), which may increase access to care and decrease 
healthcare delivery costs. Incorporating RPM in chronic disease management can significantly improve 
an individual’s quality of life. It allows patients to maintain independence, prevent complications, and 
minimize personal costs. RPM is used to monitor a variety of chronic illnesses, including diabetes, and 
transmit alerts to both the patient and the physician. 

Principle 2: Chronic Disease programs must address chronic disease across the entire continuum of 
care. 

Component 2.1 : Care planning should promote screening and identification of risk factors for patients all 
along the disease spectrum. Risk factor identification, screening, and interventions have been successful 
in identifying and preventing chronic diseases and their associated morbidity and mortality in older 
adults. Greater impact in this area will require extensive collaboration among stakeholders (providers, 
health plans, pharmacists, and patients) in order to identify hii^-risk indi\hduals. 
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Better effort needs to be made to identify patients with chronic diseases such as diabetes. The 2014 draft 
USPSTF factor-based screening guidelines for diabetes would have helped address the fact that many 
people living with Type 2 diabetes currently are not diagnosed with the disease. Prediabetes affects more 
than 1 out of 3 American adults, but 9 of 1 0 of them do not know they have it.’^‘' While the final 
guideline, released October 27, 2015, backtracked from die 2014 draft, it still opened the door for 
screening for prediabetes. 

In patients diagnosed with prediabetes or diabetes, care plans should focus on early intervention to 
prevent disease progression and complications. Health plans or other providers use data from claims, 
enrollment, and pharmacies to look for patterns of non-adherence or identify at-risk members. The use of 
in-home risk assessment also supports early identification of at-risk members, including those with and 
without diagnosed conditions. 

Component 2.2 : Comprehensive care planning must fociis on care transitions for patients with diabetes. 
One of the IMPACT Act’s stated reasons for collecting standardized data from long-term care hospitals 
(LTCHs), skilled nursing facilities (SNFs), home health agencies (HHAs) and inpatient rehabilitation 
facilities (IRFs), is to “improve hospital and PAC [post-acute care] discharge planning.” And as the ADA 
notes in its 2015 Standards, “Diabetes discharge planning should start at hospital admission, and clear 
diabetes management instructions should be provided at discharge.’”'**'' 

Numerous ongoing projects are testing evidence-based models for patient transitions from hospitals into 
their communities. For example, the Patient-Centered Outcomes Research Institute (PCORI) is funding 
the $15 million Project ACHIEVE (Achieving Patient-Centered Care and Optimized Health In Care 
Transitions by Evaluating the Value of Evidence), which will “develop recommendations on best 
practices for the design, implementation and large-scale national spread of highly effective, patient- 
centered care transition programs.”***''' The identification of evidence-based strategies for transitions, 
including patient-engagement activities, post-discharge, will be crucial for comprehensive care planning 
for patients with diabetes. 


AHRQ's Care Transitions from Hospital to Home: IDEAL Discharge Planning Implementation HandboolC^' describes 
best practices in the management of heart failure, heart attack, and pneumonia, among four high-performing US 
hospitals (with respect to readmissions). This information could be useful for developing care transition strategies for 
diabetes. 

8 “A focus on improving ciinicai quality and patient care with the belief that reductions in readmissions wiii naturally 
occur as a result of these improvement efforts. 

m Attention to discharge planning from the firet day of patients’ stay, typically within 8 hours of admission. This 
includes staff assessment of patients’ risk factors, needs, available resources, knowledge of disease, and family 
support. 

* Care coordination after discharge. Two hospitals scheduled follow up appointments for most of their patients prior 
to discharge. Because of limited resources, the two other hospitals made follow up appointments on an ad hoc 
basis for the neediest patients. Alt hospitals coordinated with home health agencies and connected patients to 
community resources. 

m Empowering patients through educational activities throughout the stay to help patients understand their conditions; 
manage their diet, activities, medications, and care regimens: and know when to seek care.”’'^" 
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AHRQ also provides specific guidance on sound practices in discharge planning: (a) medication 
reconciliation (e.g., “The patient’s medications must be cross-checked to ensure that no chronic 
medications were stopped and to ensure the safety of new prescriptions”); and (b) structured discharge 
communication (“Appointment-keeping behavior is enhanced when the inpatient team schedules 
outpatient medical follow up prior to discharge. Ideally, the inpatient care providers or case 
managers/discharge planners will schedule follow-up visit(s) with the appropriate professionals, including 
primary care provider, endocrinologist, and diabetes educator”).”^ 

Component 2.3 : Care planning should also include end-of-Hfe planning and discussions. Such 
conversations go beyond a narrow focus on resuscitation and address the broad array of concerns shared 
by most patients and families. These include fears about dying, understanding prognosis, achieving 
important end-of-life goals, and attending to physical needs. Good communication can facilitate the 
development of a comprehensive treatment plan that is medically sound and concordant with the patient's 
wishes and values.*^ 

Principle 3: Comprehensive care planning must be cognizant of issues related to the individual and 
community-level context. 

As noted above, missed treatment goals may have myriad contributing causes. Complex care planning 
must be aware of and seek to address issues related to the individual patient and their context in which 
they live. 

Component 3.1 : Care plans must empower and equip patients with the tools they need to play an active 
role in managing their diabetes. To best help patients when they return home from the clinical setting, it 
will be essential for care plans to mobilize and incorporate outpatient resources that help support patient 
engagement and adherence. 

Various studies have been conducted to test outpatient strategies to improve medication adherence for 
patients with diabetes. For example, the Joslin Diabetes Center developed the Diabetes Outpatient 
Intensive Treatment (DOIT) program is an interactive, 3.5 day-group education and skills training 
experience that was supplemented with daily medication management. The program led to significant 
improvements in AIC levels.'^*' Furthermore, tailored “health coaching” interventions have also been 
shown to improve medication adherence among patients with diabetes.’^'' Additionally, a community 
pharmacy-based medication therapy management (MTM) program for patients with both hypertension 
and diabetes was found to improve blood pr^sure control,’^'”' Finally, the American Pharmacists 
Association has coined the concept of diabetes “patient credentialing” as part of disease self-management 
interventions to describe “people who have a certain diagnosis and have achieved certain levels of 
competency in understanding and managing their disease,”***'' 

DSMT programs are another important tool. For type 2 diabetes, the 2015 AHRQ Evidence Report on 
behavioral interventions for diabetes notes that intensive in-person DSMT programs (I I or more hours of 
contact time) are most effective at achieving glycemic control, and that targeting interv'entions for 
particular populations (i.e., minority groups) may also be beneficial: “our analyses showed limited benefit 
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in glycemic control from DSME programs offering <10 hours of contact with delivery personnel and 
suggested that in-person delivery of behavioral programs is more beneficial than communicating the 
information with incorporation of technology. Behavioral programs seem to benefit individuals having 
suboptimal or poor glycemic control more than those with good control. Tailoring programs to ethnic 
minorities appears to be beneficial.’”'^ Currently, DSMT participation rates are extremely low (7% among 
those with private insurance and 4% among those with Medicare coverage’'’'''), so increased 
communication among patients and providers about the benefit is needed, as well as greater 
reimbursement as noted above. 

Registered dieticians also play a role in providing patients with the tools needed to manage their disease. 
Nutrition therapy is an integral component of diabetes prevention, management, and self-management 
education, and the ADA recommends all individuals with diabetes should receive individualized medical 
nutrition therapy, preferably provided by a registered dietitian nutritionist (RDN).’'*^” 

This guidance is consistent with the final recommendation of the USPSTF regarding abnormal blood 
glucose: “Clinicians should offer or refer patients with abnormal blood glucose to intensive behavioral 
counseling interventions to promote a healthful diet and physical activity.’”'’"" 

This type of education has also been shown to improve quality of life for patients. In adults with type 2 
diabetes, one study of quality of life assessment reported that self-perception of health status improved 
and participants receiving MNT from RDNs felt very knowledgeable and motivated after seeing a 
dietitian. In another study of adults with type 2 diabetes receiving case management from RDNs, 1 2- 
month quality of life scores were significantly better than adults receiving usual care. Emotional stress 
was also decreased in adults with type 2 diabetes. In persons with type 1 diabetes, three studies reported 
significant improvements in quality of life (satisfaction with treatment and psychological well-being) 
despite increases in insulin injections or diet requirements.’'’"' 

The use of community health workers (CHWs) to implement diabetes-focused programs - as well as for 
obesity management, more generally - have been described in the literature. For example, the Mexican 
American Trial of Community Health Workers (a randomized, controlled trial in which CHWs delivered 
diabetes self-management training via home visits over 2 years) led to improvements in AlC levels at 
both the end of Year 1 as w'ell as Year 2 of the intervention. Regarding obesity management as a w^hole, a 
2014 JAMA systematic review found evidence for the effectiveness of intensive behavioral weight loss 
counseling led by trained interventionists, such as medical assistants and registered dieticians.’ 
Furthermore, trials testing the Weight Watchers program have found promising results with respect to 
weight loss outcomes.’’ 

Additionally, Aging and Disability Resource Centers (ADRCs) are one example of a community resource 
that may provide an opportunity for elderly people living with diabetes to utilize existing community 
resources. (ADRCs have 5 core functions: “1) information, referral and awareness, 2) options counseling, 
advice and assistance, 3) streamlined eligibility detennination for public programs, 4) person-centered 
transitions, and 5) quality assurance and continuous improvement. ADRCs perform these functions by 
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integrating, coordinating, and strengthening different pieces of the existing long term supports and 
services systems, including Area Agencies on Aging, Centers for Independent Living, state and local 
Medicaid offices, and other community-based organizations.”^') 

As the health system seeks to mobilize and incorporate community-based health and support, it may be 
helpful to draw on the experience of Medicare Advantage (MA) plans. Currently, the only tool health 
plans have to offer flexibility to the individual are medical management tools that must be offered to an 
entire population regardless of need (e.g., waiving or eliminating copays on certain medications for one 
population, providing additional transportation to individuals with more fi’equent medical appointments or 
waiving the copay on a type of specialist visit based on an individuars health needs). MA plans should 
be given flexibility to permit providers to develop individualized care plans that tailor tools to support 
patient needs. Further, some services plans want to provide do not fall within medical necessity. 

Examples of such services are: homemaker services, home-delivered meals, personal care services 
(assistance with bathing and dressing), transportation escort services, inpatient custodial level care, in- 
home caregiver relief, adult day care services, and non-Medicare-covered medical and safety equipment 
(e.g., the purchase of a refrigerator to store insulin, an air conditioner in geographies with severe summer 
temperatures or railings to help prevent falls). 

Online and community-based and health providers such as Weight Watchers, Y-USA, and Omada Health 
that provide CDC-certified diabetes prevention programs offering DPP are also examples of organizations 
that care plans should look to for assistance in helping patients maintain adherence to treatment plans. 
Community-based programs such as these are especially important for patients in traditional underserved 
and minority communities or communities with a high level of mistrust of the traditional medical system. 

Component 3.2 : Diabetes care plans should use health literacy assessments as a tool to inform appropriate 
interventions for individual patients. A study in JAMA on health literacy and diabetes'"' found that 
patients with inadequate health literacy were less likely than patients with adequate health literacy to 
achieve tight glycemic control, were more likely to have poor glycemic control, and report having 
diabetic retinopathy. By using data to identify which patients are most at risk of becoming non-adherent, 
physicians can best determine which patient engagement strategies to utilize. This also reduces the level 
of outreach to low-risk patients (those most likely to adhere) and ultimately allows for more targeted 
deployment of resources and time to the most at-risk patients. 

Furthermore, care plans should adopt best-evidence practices in reaching low-literacy patients. As an 
article in the American Journal of Health Behmnor on health education for low-literacy audiences noted, 
“Materials should be focused on offering practical strategies for behavior change, the ‘need to do’, rather 
than focused on teaching facts, the ‘need to know.’”"''’ 

Component 3.3 : Diabetes care plans should incorporate best practices in person-centered, culturally- 
appropriate guidance for patients with diabetes to address specific cultural beliefs about health (e.g., in 
some cultures one does not seek healthcare until symptoms have already developed). To the extent that 
these beliefs modify health-seeking behaviors, care plans need to adopt strategies described in the 
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literature, such as the use of culturally-salient metaphors for describing diabetes as a disease in terms that 
certain community members will identify with.*'" 


Guidance from the American Association of Diabetes Educators and tiie National Standards for Diabetes Self- 

Management Education and Support may be particularly useful guidelines in this regard; 

“mhe prudent diabetes educator provides important information, care, and support to persons affected by 

diabetes in a manner that: 

$5 Acknowledges that cultural perceptions of health can be unique for each individual. 

s Considers the context of learning experiences already present w4ien developing collaborative efforts with the 
patient to identify barriers to diabetes care succ^s. 

m Conveys accurate information in a fashion that is understandable to the learner. Proactively addresses 
limitations to seif-management plan adherence and designs/brokers culturally appropriate goals. 

B Utilizes educational materials and resources appropriate for culture, age. literacy level, and learning readiness. 

^ Includes resources that address access limitations to diabetes-care needs and considers the milieu in which the 
care plan is to be executed. 

« Incorporates sensitivity and respect when educating all people irrespective of ethnicity, race, age. and 
socioeconomic status.”''" 


ConokjsioiJs 

Comprehensive care planning for diabetes requires a holistic, patient-centered approach that spans the 
continuum of care. These three principles and their components underscore NDHI’s vision to ensure 
patient adherence and maximizing quality outcomes for diabetes. Thus, comprehensive care planning for 
diabetes may provide useful lessons for action to address other chronic diseases. 

Medication Therapy Management (MTM) Models: Standard versus Enhanced MTM 

A critical component of providing coordinated care includes medication adherence. This section explores 
improvements to a specific program -- Medicare’s medication therapy management (MTM) program, 
which needs to be improved in order to provide better value. 

The Medicare Modernization Act (MMA), which created the Part D program, requires that every Part D 
plan offer a medication therapy management (MTM) program as a quality improvement feature. 

However, misaligned incentives inhibit the program from achieving significant benefits. In September 
2015, CMS announced its intent to form a Part D Enhanced MTM Model to test changes to the Part D 
program that would achieve better alignment of prescription drug plan (PDP) sponsor and government 
financial interests, while also creating incentives for robust investment and innovation in better MTM 
targeting and interventions. * 

Below, we examine the new “enhanced” model and areas for improvement. 


’ All quotes in this document are from Centers for Medicare & Medicaid Services. CMS Part D Enhanced Medication Therapy 
Management Model Fact Sheet. September 28, 201 5. 
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able 1. Part D Enhanced MTM Model; Positive Features and Areas for Improvement 




GENERAL 




Emphasis on regulatory flexibility will allow 
targeting of high-risk beneficiaries and provide 
appropriate level and intensity of service {allows 
PDFs to stratify services by beneficiary risk; allov^ 
different levels and types of MTM services). 
Waivers will allow various providers to offer 
interventions of a type that are not usually furnished 
in traditional MTM programs. 


m Timing of the mode! delays beneficial change. The 
model will result in a potential delay of seven to 1 0 
years from today before the model’s benefits can be 
extended to all beneficiaries since the model does 
not start until 201 7, runs for five years, and will be 
evaluated. . . . 

« The design does not address the value of offering 
these benefits to all Part D membei^ (including MA- 
PD plans) to achieve better alignment of PDP 
sponsor and government financial interests and 
optimize therapeutic outcomes. 
m Restriction of the model over the five year 
demonstration creates unfair competitive 
disadvantage for plan sponsors outside the 
designated regions. Additionally, all PDF plans 
under a single contract should be able to participate, 
rather than be forced to split the contract (creating 
administrative burden for CMS and plans, as well as 
denying the benefits of the enhanced model to some 
patients served by the contract). 


Payment Incentives 

s “Prospective payment for more extensive MTM 
interventions that will be “outside” of a plan’s annual 
Part D bid”; and 

i tt “A performance payment, in the form of an increased 
direct premium subsidy, for plans that successfully 
achieve a certain level of reduction in fee-for-service 
expenditures and fulfill quality and other data 
reporting requirements through the [Enhanced] 
model.” 

Quality Measures 

a “CMS wilt develop new MTM-related data and metric 
collection requirements for both monitoring and 
evaluation purposes.” 


CMS should invest in research to determine whether 
these payment incentives will offset partiapating plan 
sponsors’ increased resources in the Enhanced 
MTM model. 


a CMS should provide participating plans with an 
opportunity to participate in developing the quality 
indicators that comprise the uniform set of MTM data 
elements. 

m CMS should rely on measures that have been 
developed through an intensive, transparent 
development and evaluation process such as 
employed by national quality organizations like the 
Pharmacy Quality Alliance (PQA) and the National 
Quality Forum (NQF). 

« CMS should work with stakeholders to choose 
measures that address clinical outcomes for the 
conditions selected by plans for enhanced MTM 
services to determine any potential effect that these 
services have on overall quality of care, 
a CMS should employ a public comment process that 
allows a full range of stakeholders to provide input 
into the final measure set, performance standards 
(e.g., for purposes of determining performance- 
based payments), and evaluation methods. 
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»?.• vf I LATURES ‘ 


as CMS should address the expected differences in 
Star Ratings between Part D regions CMS has 
selected to participate in the demonstration and 
those that are prohibited from participating so as not 
to penalize those non-selected regions. 

CMS should consider the different requirements of 
plans with high levels of low-income subsidy (LIS) 
enrollment (e.g., any application of financial 
incentives to plan payments must be appropriately 
adjusted for plans serving high concentrations of LIS 
members who may be more difficult to reach out to 
and serve — especially as this could impact LIS 
benchmarks also). 

CMS should also consider how to fairly measure 
quality for plans serving many LlS-eligibie enroliees 
as they develop quality metrics for monitoring and 
evaluation of the model. 


Emphasis on learning activities and plans to 
promulgate lessons 


CMS should be more explicit about how plans’ 
proprietary information can be appropriately 
protected. 

Lessons learned should be shared with plans outside 
of the model’s geographic limitations. 

CMS should take the lead in robust education of 
providers and pharmacies on the Enhanced MTM 
model test, particularly as it compares to the 
standard MTM program. Additionally, increased plan 
flexibility to customize their communications about 
the model could create confusion for many 
physicians and members about how this model test 
relates to the traditional MTM benefit. 


Stakeholder Collaboration 


CMS should reconsider its stance regarding 
manufacturer and health plan collaborations to allow 
for appropriate interactions that will result in 
improved medication adherence. 
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Health Information Interoperability 

Beyond patient engagement and adherence, a key goal of NDHI was establishing a learning health 
system^ that operationalizes high-value care through the 
pro\dsion of relevant data to the right individuals at the right 
time. Providers must be able to use patient data from many 
different sources for individual care decisions and population 
health management. NDHI recognizes that inte^ated 
information collection and sharing through expanded data 
and electronic health records (EHR) interoperability is 
critical to achieve this goal. Ultimately, a system in which 
health infonnation technology (HIT) systems interoperate 
will increase trust in the health system by all stakeholders 
and reduce the need to rely on expensive and burdensome 
tracking and reporting systems to demonstrate safety and 
quality. 

While challenges still remain, the past decade has brought 
tremendous progress towards the adoption and meaningful 
use of HIT. As a firet step toward building a system for 
electronic health data exchange among providers, Congress passed the Health Infonnation Technology 
for Economic and Clinical Health (HITECH) Act in 2009. The Act included provisions for Medicare and 
Medicaid EHR Incentive Programs to promote the adoption and meaningful use of qualified electronic 
health records through financial incentives, and mandated that the Office of the National Coordinator for 
Health Infonnation Technology (ONC) coordinate nationwide efforts to implement HIT.‘'''“ Since the law 
passed, the federal government has invested over $28 billion in HIT and has established requirements and 
measures for Meaningful Use (MU) stages that providers must meet in order to receive incentive 
payments;“’‘ and the adoption of EHRs among hospitals and physicians has increased significantly. In 
2008, 9.4% of hospitals and 16.9% of doctors had adopted an EHR system.*^ As of 2014, 75% of hospitals 
and 80% of physicians had adopted an EHR system.*^’*^ Interoperability of EHR systems has not been 
achieved at similar rates, however. For example, as of 20 1 3 only 62% of hospitals had reported being 
able to exchange electronic health information with any provider outside their organization.^'” 


“[Ijnteroperabie EHR systems could better 
enable patients and providers to: 

m view results from diagnostic procedures 
conducted by other providers to avoid 
duplication; 

* evaluate test results and treatment 
outcomes over time regardless of where 
the care was provided to better underetand 
a patient’s medical history; 
s share a basic set of patient information 
with specialists during referrals and 
receive updated Information after the 
patient's visit with the specialist to improve 
care coordination; 

s view complete medication lists to reduce 
the chance of duplicate therapy, drug 
interactions, medication abuse, and other 
adverse drug events; and identify 
important information, such as allergies or 
preexisting conditions, for unfamiliar 
patients during emergency treatment to 
reduce the risk of adverse events."''''' 


Since the passage of HITECH, several other major efforts by the public and private sectors have been 
undertaken to move toward an interoperable healthcare system. All stakeholders agree on the 
fundamental components of interoperability, but definitions of and timing for national interoperability 
differ. In an effort to move toward comprehensive interoperability. Congress passed the Medicare Access 
and CHIP Reauthorization Act (MACRA) of 2015, which declares that achieving interoperability by 

’ Acconiing to lOM, a learning health system is one “in which science, informatics, incentives, and culture are aligned for 
continuous improvement and innovation, with best practices seamlessly embedded in the delivery process and new knowledge 
captured as an integral by-product of the delivery experience.” 

htto:.'/iom.nationalacadeinies-ors/~/Tnedia'Files/Activitv%20Files'OuaIilvi'VSRT/rore%20Documents/l-eamitigHealthS vstem.pdf 
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December 31, 2018 is a national objective and directs HHS to establish related metrics. Congress also 
directed the GAO to retdew the efforts of non-govanment organizations to develop the infrastructure 
needed to support nationwide interoperability of healthcare information. In addition to reviewing selected 
nonfederal interoperability initiatives, they described key challenges related to EHR interoperability and 
the extent to W'-hich selected private sector initiative are addresing thee challenges. GAO noted that 
private sector stakeholders are using different approache to address thee key challenges: (1) 
insufficiencies in health data standards, (2) variation in state privacy rule, (3) accurately matching 
patients’ health records, (4) coste associated with interoperability, and (5) the need for governance and 
trust among entities, such as agreements to facilitate the sharing of information among all participants in 
an initiative.’’^’^''’ Although many efforts focus on the inteoi^rability of EHRs, leaders in HIT are also 
working to incorporate other types of data into an interoperable system. For example. Ascension Health's 
Center for Medical Interoperability is working to incorporate medical device data into an interoperable 
system that includes EHR data and other HIT data.**'' 


Figure 2. Key HIT and Interoperability Pending Legislation and Laws 
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Building on these efforts, ONC published the final “Connecting Health and Care for the Nation: A Shared 
Nationwide Interoperability Roadmap” in October 2015 that outlines a vision for interoperability with a 
timeline and public/private sector opportunities for achieving the goals of interoperability. ONC’s goals 

for interoperability align with those identified by NDHI: 

B Focus on value 
s Be person-centered 

s: Protect privacy and security in all aspects of 
interoperability and respect individual preferences 
ss Build a culture of electronic access and use 
® Encourage innovation and competition 
» Build upon the existing health IT infrastructure 
® One size does not fit all 
n Simplify 
m Maintain modularity 

58 Consider the current environment and support multiple 
levels of advancement 

ONC calls on the private sector and many other stakeholders to join in “helping consumers easily and 
securely access their electronic health information when and where they need it most; to enabling 
individual health information to be shared with other providers and refrain from information blocking; 
and to implementing federally recognized, national interoperability standards and policies so that we are 
no longer competing between standards, but rather innovating on a set of core standards.”'^'^*' 

Despite progress in the public and private sectors towards interoperability, NDHI also identified the 
following remaining challenges: 

m Not all EHR vendors are members of initiative alliances 

!* Point-to-point transfer does not focus on content exchanged or complex scenarios 

m Conflicting and competing standards 

m Lack of consensus on clinical workflow and payment reform best practices 
8. Limited funds to achieve patient-centered interoperability 
Integrating clinical, billing and administrative data 
® New payment models and complex provider collaborations 

In an effort to show how all stakeholders can move towards an interoperable system, NDHI identified 
three key goals to support patient-centered interoperability that are shared across the public and private 
sectors. Together, these keys will move the U.S. toward achieving a patient-centered interoperable health 
system (Figure 3). 


Stakeholders Identified by ONC Who 
Can Affect or Are Affected by 
Interoperability: 

9 People who receive care or support the 
care of others 

s People and organizations that deliver 
care and services 
Ts Organizations that pay for care 
m People and organizations 

(governmental) that support the public 
good 

ffi People and organizations that generate 
new knowledge, whether research or 
quality improvement 

* People and organizations that provide 
health IT capabilities 
c People and organizations that govern, 
certify and/or have oversight 
s People and organizations that develop 
and maintain standards’*^' 
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Figyr# 3. Keys toward Achieving Patient-Centered Interoperability 



Figures 3 and 4 highlight examples of public- and private-sector initiatives, and the “keys” (i.e., goals) to 
patient-centered interoperability they aim to achieve: (I) Secure Data Sharing; (2) Common Standards 
and Governance for Trusted Exchange; and (3) Data Preserved and Not Configtired to Information Block. 


Figure 4. Key Public and Private Sector Interoperability Initiatives 
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PatJent-Ceniered IntamperabHHy 

NDHI participants recognize that the patient must be the focus of emerging interoperable systems, and 
that an interoperable system facilitates patient-centered care. According to the Institute of Medicine 
(lOM), patient-centered care is defined as “providing care that is respectful of and responsive to 
individual patient preferences, needs, and valu^, and ensuring that patient values guide all clinical 
decisions.”'”® 

A December 2015 report by the Bipartisan Policy Center (BPC) also emphasizes the need to create a 
patient centered system and notes that “billions of dollars are being invested by federal, state, and private 
sector organizations in new healthcare delivery and payment arrangements that reward better cost and 
quality outcomes. These arrangements will require greater information sharing and interoperable 
systems. For example, clinicians and care teams will need to have access to information about the 
patient — regardless of where care has been delivered — as well as clinical decision support tools, to inform 
coordinated, clinical decision-making at the point of care and between visits.”’*" The BPC also notes that 
patients will play a critical role in improving cost and quality outcomes and that information sharing is 
critical to helping patients manage their health, make informed healthcare decisions, and navigate the 
healthcare system.'” 

Ultimately, interoperability allows for patient-centered communication mechanisms that meet the needs 
of patients, providers, and caregivers and has positive effects on a variety of outcomes {see Table 2). 
Those outcomes include: provider and patient access to health records; patient self-management support; 
increased opportunities for communication between providers, providers and patients, and providers and 
caregivers; patient engagement; shared decision making among the provider, patient, and/or caregiver; 
enhanced patient/caregiver/provider relationships; and coordinated, comprehensive care.'”' 
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Patient-Centered HIT interoperability’ 




Patient 

® Access to health records and 
reports 

ffi Information exchange 

m Prevention modalities and wellness 
strategies 

ts Evidence-based data on i 

risks/benefits of treatments — 

a Self-management 

9 eVisit 

* Facilitation of patient-physician 
interactions 

■ Increased opportunities for 
communication 

s Educated patiente have 
increased decision control 

(t4 Increased patient engagement 
s Opportunity to discuss 

psychological and social context 

s Patient health 
behaviors 

B Symptom management 
s Healthcare process 
outcomes 

B Disease specific 
outcomes 

B Health knowledge 

« Reduced medicai cost 
and time 

Reduced medical error 

s Access to care 

Caregiver 

» Continuity of care 
» Access to patient records and 
reports 

« Caregiver resources 

B Partnership with provider 

s Caregiver involvement 

reinforcres patient-provider [T'T’" 
interactions 

^ Patient advocate provides 
^ insight on patient perspective 
■ Assists in translating health 
information to patient 

B Caregiver support in decision 
making 

* Partnership fostere relationships 

Healthcare 

Provider 

n Coordinated and compr^ensive 
care 

B Collaboration between providers 
« Electronic Medical Record access 
m Standardized reporting L— — 

s Pharmaceutical dosing systems 

K intervention management 

m improved and efficient 
communication between 
providers and patient 
• Behavioral management and 
^ support outside of dinic context 
« Improved communication on 
decision making with other 
providers and patients 


’'Table recreated from “Figure 1 , Using health information technology (HIT) to impact patient-centered care through 
patient-centered communication” in Finney Rutten LJ. Agunwamba M, Greene SM, et al. Enabling patient-centered 
communication and care through health irrformatlon technology. Journal of Communication in Healthcare. 

2014; 7(4); 255-261. 

The following section provides additional details about the three keys to achieving patient-centered 
interoperability. 

Key Secure Data Sharing 

Secure data sharing ensures that patients’ privacy is protected in the process of data exchange— and while 
the data is stored. ONC explains the importance of secure data sharing: “[I]t serv-es as the basis for trust 
by ensuring that electronic health information can be shared in a secure and private manner and not 
altered in an unauthorized or unintended way, while still m^ing the information available when needed 
by those authorized to access The initiatives in Table 3 are examples of private and public sector 
efforts that promote secure data sharing {e.g., Meaningful Use), or have been successful in implementing 
systems that practice secure data sharing (e.g.. Statewide Health Information Netw^ork of New York). 


FiNAl. 


j 23 
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Table 3. Secure Data Sharing Initiatives 


Private 

CommonWell Health 

Alliance 

(CommonWell) 

The interopwable network includes identity management, record 
locator, consent management, and tmsted data access. CommonWell 
is committed to robust privacy and security for interoperability.^^^' 

Public/Private 

Statewide Health 
Information Network of 
New York (SHIN-NY) 

New Yort^’s health information exchange is an example of secure 
electronic data sharing between providers that participate in a statewde 
network.!**" 

Public 

ONC Interoperability 
Roadmap 

ONC describes its commitment to helping consumer easily and 
securely access their electronic health information when and where they 
need it most, and outlines a strategy for accomplishing this goal.'**' 

Public 

Meaningful Use 

According to ONC. "MU privacy requirements address patients’ rights 
both to: (1) have their health information protected from unauthorized 
access; and (2) access their health information.... The Meaningful Use 
security requirements protect Protected Health Information (PHI) against 
unauthorized acxiess.^**" Meaningful Use Stage 3 includes a measure to 
“conduct or review a risk analysis including addressing the 
encryption/security of data stored in CEHRT, and implement security 
updates as necessary and coirect identified security deficiencies as part 
of the EP’s, EH’s, or CAH’s risk management process."'**™ 


Key # 2: Common Standards and Governance for Trusted Exchange 
According to the GAO, standards “establish the language, structure, and data types required for 
integration among s>^tems. . . . CoUvSistent implementation of the standards by the vendors that build and 
sell EHR systems and by providers who use these systems is necessary for interoperability.”^" 

ONC explains that the standards "must be accessible nationwide and capable of handling significant and 
growing volumes of electronic health information, to ensure no one is left on the wrong side of the digital 
divide.”^“ ONC describes its vision for a system in which “we are no longer competing between 
standards, but rather innovating on a set of core standards. Examples of private and public sector 
efforts working toward common standards and governance for trusted exchange are highli^ted in Table 4. 




NORC I viable Solutions: Six Steps to Transform Healthcare Now 


Initiatives to Establish Common Standards and Governance for Trusted Exchange 



In.'tiahve 

Initiative Description 

Private 

Argonaut Project 

The purpose of the Argonaut Project is to develop a first-generation Core Data 
Services specification to enable e)q3anded information sharing for electronic 
health records and other health information technology based on Internet 
standards and archit^ural patterns and styles. Ixxxi 

Private 

Sequoia 

Carequality 

The public-private collaborative builds consensus among exchange programs to 
develop a common set of standards and specifications that enable an 
interoperable connection among them.ixxxii The collaborative established policy 
for linking data sharing networks, and a framework for implementing data sharing 
goals. Ixxxiii 

Public 

Direct Project 

"The Direct Project specifies a simple, secure, scalable, standards-based way for 
participants to send authenticated, encrypted health information directly to known, 
trusted recipients over the lntemet.’'lxxxiv “The policy direction for the Direct 

Project is provided by the Nationwide Health Information Network Workgroup of 
the HIT Policy Committee, and oversight related to technology standards is 
provided by the HIT Standards Committee." ixxxv 

Public 

ONC 

Interoperability 
Standards 
Advisory {tSA) 

ONC reports that the purpose of the ISA is; “1 ) To provide. . .a single, public list of 
the standards and implementation specifications that can best be used to fulfill 
specific clinical health information interoperability needs. 2) To reflect the results 
of ongoing dialogue, debate, and consensus among industry stakeholders when 
more than one standard or implementation specification could be listed as the 
best available. 3) To document known limitations, preconditions, and 
dependencies as well as known security patterns among referenced standards 
and implementation specifications when they are used to fulfill a specific clinical 
health IT interoperability need."lxxxvi 

Public 

ONC's 
Governance 
Framework for 
Trusted 

Electronic Health 

Information 

Exchange 

"The Governance Framework for Trusted Electronic Health information Exchange 
(the Governance Framework) is intended to serve as the Office of the National 
Coordinator for Health Information Technology’s (ONC's) guiding principles on 

HIE governance, it is meant to provide a common conceptual foundation 
applicable to all types of governance models and expresses the principles ONC 
believes are most important for HIE governance. The Governance Framework 
does not prescribe specific solutions but lays out milestones and outcomes that 
ONC expects for and from HIE governance entities as they enable electronic 
H!E."lxxxvii 


Key U3: Systems are Not Configured to Information Block 

ONC defines infonnation blocking as occurring “when persons or entities knowingly and unreasonably 
interfere with the exchange or use of electronic health information."****'”* ONC and CMS have made clear 
statements that they will not tolerate practices that block information exchange. ONC explains that 
consequences of this “blocking” of information exchange include; 


s Compromising patient’s safety, care quality, and treatment effectiveness because it withholds 
infonnation from patients and pro\aders for informed decision making; 

® Impeding progress towards reforming healthcare delivery and payment because sharing information 
seamlessly across the care continuum is fundamental to moxdng to a person-centered, high- 
perfonning healthcare system; 

® Undennining consumers’ confidence in their healthcare providers by preventing individuals from 
accessing their health infonnation and using it to make informed decisions about their health and 
healthcare; and 
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^ Preventing advances in biomedical and public health research, which require the ability to analyze 
information from many sources in order to idratify public health risks, develop new treatments and 
cures, and enable precision medicine. 

Some key government initiatives to prevent and address data blocking, as well as some private sector 
initiatives to address the issue are described in Table 5. 


Initiatives to Prevent Information Blocking 


Sector 


mitiatjve OQ>crif.bon 

Private 

CommonWeil 
and other 

EHR vendors 

CommonWeil believes health data should be available to individuals and providers 
regardless of where care occurs, and that provider access to this data be built-in health 

IT at a reasonable cost for use by a broad range of healthcare providers and the people 
they serve.>": Other EHR vendors have removed costs for providers to exchange data 
as well. 

Private 

KLAS 

measurement 

transparency 

On October 2, 2015, a broad group of EHR stakeholders agreed by consensus to 
objective measures of interoperability and ongoing reporting and to have an 
independent entity publish transparent measures of health information exchange that 
can serve as the basis for understanding our current position and trajectory.’'® 

Public 

CMS e-mail to 
report data 
blocking 

In June 201 5, CMS released an e-mail address for stakeholders to use to report 
instances of data blocking.’'®' CMS hopes to use those reports to better understand and 
address the problem of data blocking.*®" 

Public 

ONC’s Report 
to Congress 

In response to the 2015 Appropriations Act, ONC was “urged to use its certification 
program judiciously in order to ensure certified electronic health record technology 
(CEHRT) provides value to eligible hospitals, eligible providers and taxpayers. ONC 
should use its authority to certify only those products that clearly meet current 
meaningful use program standards and that do not block health Infoimation exchange. 
ONC should take steps to decertify products that proactively block the sharing of 
information because those practices frustrate congressional intent, devalue taxpayer 
investments in CEHRT, and make CEHRT less valuable and more burdensome for 
eligible hospitals and eligible providers to use.” Congress requested “a detailed report 
from ONC no later than 90 days after enactment of this act regarding the extent of the 
information blocking problem, including an estimate of the number of vendors or eligible 
hospitals or providers who block information. This detailed report should also include a 
comprehensive strategy on how to address the information blocking issue.”*®'' 

ONC issued the report in April 201 5 and notes that information blocking occurs when 
persons or entities knowingly and unreasonably interfere with the exchange or use of 
electronic health information” and notes that “there is little doubt that information 
blocking is occurring and that it is interfering with the exchange of electronic health 
information."’'" 


Conclusions 

NDHI strongly believes that the nation must move towards an interoperable health IT infrastructure that is 
both beneficial to patients and their caregivers, and workable for industry. Functional interoperability is a 
critical component to support patient-centered care, value, and continued innovation in healthcare. A 
system built on accessible information and secure, meaningful data sharing will elevate healthcare 
delivery, advance quality and cost-efficiency, and enable new strides in medical research. 
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NDHI members agreed to build upon recommendations already offered to Congress and the 
Administration by HLC to continue to work toward achieving an interoperable health IT infrastructure. 
All NDHI members agreed that: 

» Policymakers should encourage exchange of material and meaningful health data through the use 
of technologies and applications that enable bidirectional and real-time exchange of health data 
currently residing in EHR systems (e.g., open and secure API technology). 

B Policymakers should use appropriate authority to certify only those EHR technology products that 
do not block or otherwise inhibit health information exchange. The HHS Office of the National 
Coordinator should decertify Meaningful Use products that intentionally block the sharing of 
information, or that create structural, technical, or financial impediments or disincentives to the 
sharing of information. 

s The federal government, in collaboration with the private sector, should build on current and 
emerging best practices in patient identification and matching to identify solutions to ensure the 
accuracy of every patient’s identity, and the availability and accessibility of their information, absent 
lengthy and costly efforts, wherever and whenever care is needed. 

II Any interoperability requirements or incentives should be “technology neutral” and focused on 
outcomes - active interoperation between and among systems — rather than on adoption or use of 
specified technologies. It is critical that future policies do not stifle potential innovations in health 
system connectivity. 

Furthermore, the multisector members of NDHI felt that recent advances in the state of interoperability 
collaborations and technologies allowed for even more ambitious goals and recommendations. Based 
upon these impressive accomplishments, members endorsed two additional declarations: 

» There should be a national objective to achieve widespread exchange of health information through 
interoperable EHR technology nationwide on or before December 3 1 , 20 1 8 (in parallel to the 
recommendation made in the Medicare Access and CHIP Reauthorization Act). 

» Consumers should have easy and secure access their electronic health information, be able to 
direct it to any desired location, learn how their information can be shared and used, and be assured 
that this information will be effectively and safely used to benefit their health and that of their 
community. 

NDHI believes that, by bringing together the ideas and technological expertise from both the public and 
private sectors, interoperability is an achievable goal that can and should be accelerated through 
innovation and partnership between government and the private sector. Interoperability is also key to 
achieving the goals set by HHS of tying 30% of fee-for-service Medicare payments to quality or value 
through alternative payment models, such as Accountable Care Organizations (ACOs) or bundled 
payment arrangements by the end of 2016, and 50% of payments to these models by the end of 2018. 

HHS has also set a goal of tying 85% of all traditional Medicare payments to quality or value by 2016 and 
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90% by 20 1 8 through programs such as the Hc^pital Value Based Purchasing and the Hospital 
Readmissions Reduction Programs.*'^' 

Therefore, as efforts to reform our healthcare system accelerate, all parts must move in tandem. 
Meaningful interoperation is a necessary tool to meet the ambitious goals laid out by both private sector 
organizations and the federal government to enact value-based payment reforms, new care models, and 
allow greater consumer access and control of their healthcare. 

Oiitdafed and/or Ineffective Laws and Regulations 

As the healthcare system transfonns to reward better value, increased coordination, and a more 
empowered consumer, NDHI finds that some laws and regulations that were once important to the 
healthcare system may no longer be applicable or may inhibit transformation efforts in unintended ways. 
These outdated and/or ineffective healthcare laws and regulations, enacted with the consumer’s best 
interest in mind, no longer serve the best interests of the healthcare consumer or healthcare system as a 
whole. As our healthcare system shifts from fee-for-service to value-based models evaluated through 
outcomes, many burdensome rules governing process have become unnecessary and redundant. Once 
payment and outcomes are aligned, there is less need for government regulation on process, since 
consumers and healthcare organizations share healthcare goals and responsibility for achieving them. 
Laws designed to prevent anticompetitive behavior, for example, now sometimes hinder the coordination 
needed for the best patient care. Additionally, wide variation among the regulatory approaches of 
agencies, states, and others leads to compliance efforts that cause more harm to patient outcomes than the 
risks they are intended to mitigate. Duplicative and outdated laws and regulations may impose an 
unnecessary burden on various sectors of the health system, which can negatively affect innovation and 
hinder care coordination. 

For example, the Federal Anti-Kickback Statute and the Physician Self-Referral (Stark) Law are designed 
to ensure the inte^ty of federal healthcare programs and prevent inappropriate or undue influence on 
clinical decision-making that may lead to unnecessary overutilization of federal healthcare resources. 
These laws and their regulations prohibit certain financial arrangements between and among providers 
and other stakeholders. However, in their current fonn, they may inhibit current priority initiatives - such 
as medical homes, bundled payments and accountable care organizations (ACOs) - that are designed to 
promote value and care coordination among providers by aligning financial incentives for improved 
outcomes. For example, waivers of these laws and regulations were created to protect ACOs participating 
in the Medicare Shared Savings Program so that participants will not face liability for aligning financial 
incentives among providers provided certain requirements are met. Further, in the context of priority 
payment and delivery arrangements that can improve quality and lower costs (e.g. bundling, gainsharing), 
these laws and regulations may foreclose such arrangements because such arrangements were not 
envisioned when the laws and regulations were originally developed and any safe harbors and/or 
exceptions do not provide specific protection. For example, a physician who adopts a bundled payment 
arrangement in collaboration with a team of physicians and other providers may violate the Federal Anti- 
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Kickback Statute. Or, a physician who seeks to provide additional services like patient reward programs 
or add-on care management services, may implicate the Federal Anti-Kickback Statute or the civil 
monetary penalty (CMP) law prohibiting beneficiary inducements. While these laws and regulations are 
intended to protect patients and federal health programs from fraud and abuse, their broad scope and 
application implicates virtually all healthcare arrangements between and among providers and other 
industry participants. This complex web of laws and regulations and related compliance efforts may now 
inhibit arrangements designed to encourage hospitals and doctors to collaborate to improve patient care in 
a clinical integration program. 

Further, various regulations create restrictions on data movement and usage, which often constrain 
providers from pursuing alternative payment models and even research initiatives. As health plans and 
providers and the medical research community continue to focus on outcomes research and innovation, it 
is important that the exchange and aggregated use of healthcare data be allowed. The HIPAA Privacy 
Rule strictly defines what constitutes protected health information (PHI) and defines certain institutions, 
or covered entities that hold such infomiation. The Federal Policy for the Protection of Human Subjects 
or “Common Rule” defines the protection of human subjects in research. Without modifications to 
harmonize the rules, unnecessary barriers to data movement will continue to limit the innovative potential 
of the healthcare marketplace, especially as PHI continues to migrate out of the traditional healthcare 
system. 

The misinterpretation and lack of alignment around privacy, security, and enforcement regulations - 
developed to safeguard patients’ personal health information - hampers data sharing necessary for 
alternative payment models and research. Currently, researchers need to contend not only with the 
HIPAA Privacy Rules regulating research but also with state law, and in many cases, additional federal 
law, for example, the Federal Privacy Act of 1 974, the so-called Common Rule, FDA Regulations, and 
other regulations. This results in a confusing and inconsistent set of requirements, often governing the 
same study (for example, in the case of a multi-site study in different states). 

Finally, advances in technology and data sharing allow for better outcome tracking and faster iteration of 
improvements in breakthrough treatments and technologies while manufacturers are still limited by 
outdated regulations from the FDA that delay access to breakthrough treatments and technologies. 

Various policies within the FDA’s purview have facilitated delays in both the approval of and access to 
innovative medical technology and treatments. Encouraging policy change that streamlines FDA’s 
responsibilities, while ensuring that companies remain accountable, could reduce FDA’s workload, 
allowing it to focus on higher-priority activities, and would represent a significant cost and time saving 
for the private sector and the federal goverranent. 

In an effort to accelerate the development of new treatments, improve care coordination, and facilitate 
health system transformation, NDHI identified three key categories in need of reform: the regulation of 
competition in healthcare, the flow of health information between health organizations, and 
modernization of key FDA rules and regulations — while ensuring that innovators remain accountable. 
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Possible Changes to the Federal Anti-Kickback Statute and Physician Self-Referral 
(Stark) Lav«/ to Foster integrated Cars Delivery and Payment Models 

As the U.S, healthcare system continues to move toward quality-driven, value-based care delivery and 
payment models, policy and implementation challenges arise as these models may implicate the federal 
fraud and abuse legal framework. In general, the fraud and abuse legal framework is designed to penalize 
arrangements between and among providers and other industry stakeholders that have the potential to 
encourage overutiiization of healthcare resources, inapjn-opriately influence provider decisionrmaking, 
decrease competition among competitors, and harm patients. To improve quality of care and reduce 
costs, new care delivery and payment models are deigned to encourage greater integration, and 
coordination of care and payment between and among providers and other industry stakeholders. These 
models may align financial interests in ways that trigger fraud and abuse concerns. 


As such, stakeholders across the healthcare system as well as policymakers, and legislators are 
considering whether changes to the current framework are needed to make it more compatible with 
healthcare delivery system transformation while 
retaining appropriate protections against fraud 
and abuse. 

Many other federal statutes and regulations are 
potentially implicated by these new models (e.g., 

Civil Monetary Penalties (CMP) Law (including 
the beneficiary inducement and gainsharing 
provisions), the Civil and Criminal False Claims 
Acts (FCA), HIPAA, antitrust and tax law, and 
state laws that overlap with, mirror, or relate to 
these federal laws. However, NDHI participants 
decided to focus their efforts primarily on the 
Federal Anti-Kickback Statute and Physician 
Self-Referral (Stark) Law as primarily and 
respectively enforced by HHS, Office of Inspector General (OIG), and CMS. 

While this report does not address the other federal and state laws noted above, it is particularly important 
to note the relationship between the Federal Anti-Kickback Statute and the Civil Monetary Penalties 
(CMP) Law as they relate to both beneficiary inducement (i.e., providing anything of value to a patient in 
order to encourage the patient to utilize a particular provider, device, or pharmaceutical) and gainsharing 
(i.e., sharing savings among providers). It is common for arrangements between industry stakeholders 
(e.g., medical device and pharmaceutical manufacturers and providers) to potentially implicate both the 
Anti-Kickback Statute and the CMP law. For example, routinely waiving patient co-payments potentially 
implicates both the CMP Law’s beneficiary inducement provisions as well as the Anti-Kickback Statute, 
which prohibits a co-payment waiver because it constitutes something of value provided to a patient. As 


CMS Payment Waiver Policy 

CMS should expand the waiver for patient incentives 
under the Medicare Shared Savings Program (MSSP) to 
all CMMl demonstrations. The current waiver gives ACOs 
the flexibility to encourage preventive care and patient 
compliance with treatment regimens without facing CMP 
due to beneficiary inducements. PPACA does authorize 
the waiver of the program integrity laws for CMMl 
demonstrations, but CMMl has largely issued guidance 
regarding such waivers on a case-by-case basis. While 
this information helps to ameliorate the concerns of 
would-be participants in CMMl demonstrations, concrete 
assurances in the form of prospective, bright line waivers 
could spur greater confidence and participation. 
Additionally, CMS should expand these permissions (such 
as the ability to waive copays) to private sector ACOs, 
which operate with the same incentives as those in CMS 
demonstration programs. 
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such, when considering potential changes to the Anti-Kickback Statute, stakeholders also should consider 
related changes to the CMP Law to ensure consistency in interpretation and application across both laws. 

For reference, this report provides some background information on the Federal Anti-Kickback Statute 
and Physician Self-Referral (Stark) Law as well as an overview of recent regulatory and legislative 
changes that provide additional context for the discussion of possible options to modify these legal 
frameworks. 

It is important to note that alignment of the fraud and abuse legal framework with new care delivery and 
payment models is being discussed at multiple levels across the healthcare system. The recent Medicare 
Access and CHIP Reauthorization Act of 2015 (MACRA) called for the HHS Secretary, in coordination 
with the OIG, to consider possible modifications to the legal frameworks to better align with integrated 
care delivery and payment models. In addition, CMS solicited feedback on possible changes to the Stark 
Law in the 2016 Physician Fee Schedule Proposed Rule indicating that the agency is thinking about these 
issues and open to dialogue regarding modifications. In the Final Rule, CMS stated that it will consider 
the comments received when preparing MACRA-mandated reports to Congress. 

The Current Legal Framework 

Federal AniFKickback Statute and Physician Seif-Referra! (Stark) Law 

The Federal Anti-Kickback Statute and Physician Self-Referral (Stark) Law regulate arrangements 
between and among healthcare industry participants. The Anti-Kickback Statute prohibits any individual 
from knowingly and willfully offering, paying, soliciting, or receiving anything of value in return for a 
referral or to induce the generation of business reimbursable by a federal healthcare program.’“^'’“ This 
prohibition applies to all healthcare industry participants, including institutional and individual providers 
and medical device and pharmaceutical manufacturers and suppliers. The Stark Law prohibits physicians 
from referring Medicare patients for certain services to an entity with which the physician (or an 
immediate family member) has a financial relationship.’'*^'”' The Stark Law also prohibits healthcare 
organizations from billing Medicare for services provided pursuant to an improper referral. 

The Anti-Kickback Statute is a criminal law and intent is required for liability to attach; penalties for 
violating the statute include imprisonment and substantial fines. In contrast, the Stark Law is a law of 
strict liability, meaning that no intent to violate the law is required. Civil monetary penalties may be 
levied for violations of the Anti-Kickback Statute and the Stark Law, and entities that violate either may 
be excluded from participation in federal healthcare programs. 

There are exceptions to each law (referred to as “safe harbors” for the Anti-Kickback Statute and 
“exceptions'” for the Stark Law) that protect certain types of business arrangements and transactions that 
are considered to present a minimal risk of fraud or abuse when structured appropriately (i.e., in 
accordance with exact requirements of an exception). The exceptions and associated requirements are not 
the same across both laws, though there is overlap. Generally, exceptions include payments made in the 
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course of legitimate business dealings (e.g., salaries paid to bona fide employees) and payments made for 
services integral to healthcare delivery (e.g., persoiml services contracts). 

Recent Legislative and Regulatory Changes 

1. ) General Changes to Fraud and Abuse Laws; The Medicare Access and CHIP Reauthorization Act of 

2015 (MACRA)^‘^‘^ contained several provisions relevant to the fraud and abuse laws in general, 
including; 

m Requiring the Secretary of HHS, in consultation with the OIG, to: 

i. Study the applicability of fraud prevention laws under alternative payment models 
(APMs), identify aspects of APMs vulnerable to fraud, and examine implications of 
waivers to APMs. The Secretary must report to Congress on its findings and provide 
recommendations on how to reduce APMs’ vulnerability to fraud by April 16, 2017;‘' 
and 

ii. Submit a report to Congress by April 16, 2016 with options for amending existing 
Medicare and Medicaid fraud and abuse laws and regulations through exceptions or 
safe harbors to permit gainsharing or similar arrangements between physicians and 
hospitals that would improve care while reducing waste and inefficiency.^^' 

s Narrowing the gainsharing Civil Monetary Penalty Law^" so that it only applies to reductions or 
limitations of medically necessary services.*"*’ 

2. ) Stark Law Changes in Physician Fee Schedule: CMS routinely uses payment rules to amend the Stark 

Law regulations. In July 2015, CMS issued a proposed 2016 Medicare Physician Fee Schedule""' in 
which it referenced its history of using such rulemakings to make changes to the Stark law, detailed 
proposed changes to the law, and requested public feedback about these changes, which included:'"' 

M Two new Stark exceptions (covering payments to physicians to employ non-physician 
practitioners and timeshare arrangements for the use of office space, equipment, personnel, 
supplies, and other services that benefit rural or underserved areas); 
s Guidance and clarification related to financial relationship documentation and requirements 
specific to certain financial relationships; and 

8 Clarifying Patient Protection and Affordable Care Act of 2010 (ACA)-mandated limitations on 
the whole hospital exception. 

CMS finalized the proposed changes with minor modifications on October 30, 2015 in a final rule with 
comment period.'"'' In the proposed rule, CMS sought public comment regarding the impact of the Stark 
law on healthcare delivery and payment reform, and specifically asked for feedback on perceived Stark- 
related barriers to clinical and financial integration.'""' CMS also posed specific questions for stakeholder 
input regarding the need for guidance on the application of aspects of the Stark regulations to physician 
compensation unrelated to participation in APMs. In the final rule, CMS stated that it will carefully 
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consider comments received in response to these questions when preparing reports to Congress as 
mandated by MACRA“" and in determining the necessity of additional rulemaking on these issues.™ 

3. ) Medicare Shared Savings Program: The ACA made several changes that impact the fraud and abuse 

laws. One major change was the creation of the Medicare “Shared Savings Program” (MSSP), which 
allows groups of providers to create ACOs and share in the savings generated by reducing the overall 
cost of providing care to an assigned population of Medicare beneficiaries. CMS and the OIG 
published interim final rules on November 2, 2011 waiving certain provisions of the Stark Law and 
the Anti-Kickback Statute that would limit ACO arrangements within the MSSP.‘’‘ These provisions 
were extended through November 2, 2015 by a continuation notice published in 2014. CMS has 
authority to issue waivers of the federal fraud and abuse laws as may be necessary to test models for 
improving care delivery or reducing expenditures and is likely to do so in relation to other CMMI 
models. Three other changes made directly to the fraud and abuse laws by the ACA include: 

s Relaxed the Anti-Kickback Statute's intent requirement (clarifying that an individual or entity 
need not intend to violate the Statute or even know the Statute exists to have the requisite level of 
intent); 

• Added disclosure requirements to the Stark Law’s in-office ancillary services exception 
applicable to certain imaging services; and 

» Removed the “whole hospital exception” (commonly referred to as specialty hospitals) to the 
Stark law, with limited grandfathering for existing arrangements. 

4. ) E-prescribing and EHRs: The Medicare Prescription Drug Improvement and Modernization Act 

(MMA) of 2003 mandated the development of an Anti-Kickback Statute safe harbor and a Stark 
. exception to promote e-prescribing technology adoption. In 2006, CMS and the OIG issued final 
rules furthering this mandate via two exceptions: ( 1 ) certain providers and health plans may subsidize 
100% of e-prescribing system hardware, software, training, and support for certain related entities; 
and (2) through 2013, any provider or health plan may subsidize up to 85% of electronic health record 
(EHR) software and/or related technology and training services for any provider,"' The preambles of 
both final rules provide an illustrative but non-exhaustive list of EHR software and related 
technologies that would be considered covered technology within the donation exception."" These 
examples include: connectivity services, clinical and information support services related to patient 
care, maintenance services, and secure messaging. The final rules specifically exclude certain items 
and services, including storage devices and software with core functionality other than electronic 
health records, such as payroll software. On December 27, 2013, the OIG and CMS issued joint final 
regulations extending the EHR exception through 202 1 and modifying some of its requirements."” In 
response to stakeholder concerns about the scope of covered technology, the final rules note the 
importance of maintaining flexibility in the definition, particularly as health information technology 
evolves."'' The rules declined to expand on the illustrative list provided in the 2006 final rule or to 
memorialize that list within the regulatory text and noted that revising the definition could 
inadvertently narrow the exception. The final rules emphasize whether specific items and services are 
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considered covered technology under the exception is dqjendent on the particular items or services. 
Specifically, donated items or services must be necessary and used predominantly to create, maintain, 
transmit, or receive electronic health records to qualify for the exception. The final rules suggest the 
possibility of expanding the scope of covered technology in the future.^’^'' 

Recent Guidance 

1 . ) Information Blocking: The OIG issued an Alert on October 6, 2015 dealing with information 

blocking and the EHR safe harbor exception to the Anti-Kickback Statute.'^’'''’ The Alert notes that 
donation of [EHR] items or services that have limited or restricted interoperability due to action 
taken by the donor or anyone on the donor’s behalf would not fall within the EHR donation safe 
harbor. OIG believes that charging fees to deter non-recipient providers and suppliers and the 
donor’s competitors from interfacing with the donated items or services would pose “legitimate 
concerns” that parties were improj^ly locking-in data and referrals and thus that the arrangement 
in question would not qualify for safe harbor protection. 

2. ) Medicare and Medicaid Discharge Planning Requirements: CMS released a proposed rule on 

October 29, 20 1 5 revising Medicare and Medicaid discharge planning requirements for acute 
care, long-term care, and critical access hospitals, inpatient rehabilitation facilities, and home 
health agencies.'^’^’^” The rule would implement the Improving Medicare Post-Acute Care 
Transformation (IMPACT) Act of 2014's discharge planning provisions, which modifies 
conditions of participation (COPs) to require post-acute care providers, hospitals, and critical 
access hospitals to account for quality, resource use, and similar measures in the discharge 
planning process. The rule would require these entities to use and share data on quality and 
resource use measures to assist patients in selecting post-acute care providers. 

The list below represents potential priority regulatory and legislative options to modify two of the primary 
fraud and abuse laws (the Federal Anti-Kickback Statute and Physician Self-Referral (Stark) Law) to 
better support innovative and integrated care delivery and payment models. These changes may be 
pursued independently or concurrently and some of the options may lend themselves to both regulatory 
and legislative action. It is not intended to be, nor should it be construed as an exhaustive analysis of the 
universe of potential modifications to th^e laws. The priority options, categorized as either Regulatory 
or Legislative, were selected by the National Dialogue for Healthcare Innovation initiative based on the 
following criteria: 

Feasibility: Willingness of Congress, CMS and/or OIG to address 

Impact: Potential to alleviate and/or eliminate perceived and/or real barriers to developing and 
implementing new models of care delivery and payment based on fraud and abuse framework 
Timeliness: Whether meaningful action may/can be taken in the next 6-12 months 
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While the options are categorized as regulatory and legislative, it is important to note that they may be 

pursued independently or concurrently and some of the options may lend themselves to both regulatory 

and legislative action. 

Regulaiory Options 

s Create Anti-Kickback Statute and Stark Law waivers for all ACOs that meet certain conditions, 
whether those ACOs are participating in the Medicare Shared Savings Program (MSSP) or not. 

* Extend existing Anti-Kickback Statute and Stark Law exceptions for donation and financial support 
of EHR software, related technologies, and training beyond 202 1 . As part of an extension, ensure 
range of relevant and appropriate interoperable technologies that en able meaningfiil improvements in 
healthcare delivery and health information exchange are included based on the evolving technological 
environment. 

s Clarify how to establish, document, and apply the “volume or value of referrals” standard within the 
changing healthcare payment environment. 

® Expand and revise definition of fair market value to account for new payment models that incentivize 
performance”''"' (e.g., payment for consulting services or other professional services, such as medical 
directorships). 

m Eliminate or redefine the “one purpose” test for Anti-Kickback Statute liability and replace it with a 
balancing test that would require the OIG to prove either increased cost or actual harm to a patient.^"’^ 
This would potentially allow, for example, arrangements where providers and/or medical device or 
pharmaceutical manufacturers provide items or services of value to patients to assist with prescription 
medication adherence or access to healthcare services. The OIG could assess the arrangement’s 
overall impact on quality of care and weigh these benefits against the potential risk of fraud and abuse 
to determine whether the transaction is permissible, regardless of whether one purpose of the 
arrangement is potentially problematic. 

m See references under Legislative Options to changes that may be made through legislation and/or 
regulation to the Anti-Kickback Statute, Stark Law, and the CMP Law based on the HHS Secretary’s 
findings related to the assessment of the application of the laws in the current context of healthcare 
transformation. 

Legislative Options 

s Expand the parameters of the MACRA-mandated gainsharing report (due by April 1 6, 2016) and 
alternative payment model report (due by April 1 6, 20 1 and require the HHS Secretary to review 
and assess the Anti-Kickback Statute, the Stark Law, and the CMP Law in the context of the 
transformation of the healthcare system, specifically addressing: ( 1 ) whether these laws create 
unnecessary barriers to integrated care delivery and pajment models; (2) whether these laws are 
effective in limiting fraudulent behavior; and (3) whether these laws should be modified to more 
effectively limit fraud and abuse without limiting new care and payment models aimed at providing 
better care at lower costs. The review process for both reports should include subject matter experts 
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from CMS and the OIG and the Secretary also should consult with the Department of Justice (DOJ), 
Internal Revenue Service (IRS), and the Federal Trade Commission (FTC). In addition, the Secretary 
should allow for opportunities for stakeholder input that would include medical practitioners and 
administrators, pharmaceutical and medical device manufacturers and suppliers, consumers, and legal 
and policy experts to review the Secretary’s findings and assessment. Findings from the ass^sment 
along with stakeholders’ feedback could be included in both reports, which also should include plans 
of action to address any suggested changes to the legal frameworks that arise from the assessment, as 
well as a description of the actions needed to achieve those changes. 

» Changes identified through the assessment and reports noted above may yield opportunities for either 
legislative or regulatory action to amend the Anti-Kickback Statute, Stark Law, and CMP Law to 
protect arrangements that promote increased quality and lower costs. 

B Congress also may consider granting OIG and CMS broader regulatory flexibility/rulemaking 
discretion to develop exceptions/safe harbors that are consistent with broad policy objectives (e.g., 
increase efficiency and quality and decrease costs) and adapt the Anti-Kickback Statute, the Stark 
Law, and the CMP Law to the current healthcare environment.'^’*' Note that OIG and CMS already 
have statutory authority to create safe harbors and exceptions, but Congress could direct them to do so 
with respect to specific areas and/or in specific ways based on findings from the assessment and/or 
reports. 

n The HLC and the NDHI will participate actively in opportunities for comment and will consider 
further suggestions based on the Secretary’s findings. 

HeaHh Information Flow and Usage 

There is growing interest in using data to better understand how to optimize the practice of medicine, the 
delivery of healthcare and new approaches to wellness and prevention of illness. At the same time, access 
to data needs to be balanced with the public’s concern about the confidentiality and use of health data. 

As data is appropriately accessed, it is vital to understand how to safely use these data to generate 
information for evidence-based care, share the data, analyze the data, and predict future needs of our 
complex healthcare delivery system. These data are fundamental to designing, implementing and 
evaluating innovative approaches to payment and financing reform and value-based delivery system 
reform, as well as medical breakthroughs. 

Consistent Legal Requirements 

Section 262 of the Health Insurance Portability and Accountability Act of 1 996 (HIPAA) defines “health 
information.” as “any information, whether oral or recorded in any fonn or medium, that (A) is created or 
received by a healthcare provider, health plan, public health authority, employer, life insurer, school or 
university, or healthcare clearinghouse; and (B) relates to the past, present, or future physical or mental 
health or condition of any individual, the provision of healthcare to an individual, or the past, present, or 
future payment for the provision of healthcare to an indiMdual.”.'^’*" HIPAA was designed to ensure that 
individuals’ health information is protected while allowing the flow of health information needed to 
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provide high quality healthcare. HIPAA was also designed to protect the privacy of individuals’ 
electronic health information while allowing die adoption of new technologies that will improve the 
quality and efficiency of patient care. Therefore, as noted by ONC, it is important to reconcile barriers 
that may be caused by HIPAA at the same time that the goals and protections are maintained.'^’^'" 

One particularly burdensome barrier to nationwide health information exchange is the many diverse state 
laws across the country regulating health information alongside HIPAA. These many state privacy and 
information sharing laws create enormous complexity resulting in substantial impediments to the 
implementation of health information exchanges within and across state borders. Healthcare 
organizations have long advocated for the harmonization of national and state privacy and security 
requirements in order to simplify compliance and facilitate greater information sharing, and promote 
patient access. We believe that a broader harmonization that would clearly incorporate the Health 
Insurance Portability and Accountability Act (HIPAA) governing standards would benefit the healthcare 
system without creating any material adverse impact on individuals. 

Recent work by ONC"^'' to outline a path forw'ard for harmonization of conflicting, confusing, and 
burdensome state privacy laws provides new hope for efforts to simplify the protection of health 
information. Efforts to educate states on existing federal standards and begin a dialogue on this important 
problem are important. With regard to the critical actions outlined in the roadmap, we believe there is 
both precedent and will for an accelerated timeline with stakeholders acting alongside ONC. Specifically, 
a discussion with nationwide stakeholders should include possible action items, such as harmonization of 
state and federal law. 

Patient Matching 

Creating a balance between safe and legal sharing of information with the need to consistently and 
accurately match patient data creates a number of problems for physicians and other healthcare providers. 
Without accurate sharing, providers may have an incomplete view of a patient’s medical history, care 
may not be well coordinated with other providers treating the patient, patient records may be overlaid, 
unnecessary testing or improper treatment may be ordered, and patient confidence may be eroded. 

Barriers to data sharing may also cause providers to face costly clinical workflow inefficiencies and 
potential inaccuracies including identifying the correct patient record, ordering duplicate tests, and failing 
to protect patient privacy preferences.'^"'' 

For EHRs to deliver on the promise of better healthcare, they need to ensure that patient data are sent and 
received easily among providers across disparate systems. These shared records must be accurate and 
useable. Patient matching is critical to the successful sharing of patient records, but patient data matching 
is an ongoing obstacle to seamless information exchange between organizations. 

The ONC recently performed an assessment of current industry capabilities and best practices for patient 
identification and matching with a focus on matching records among different organizations providing 
care to a specific individual. The Patient Identification and Matching Initiative focused on identifying 
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incremental steps to help ensure the accuracy of every patient’s identity, and the availability of their 
infonnation wherever and whenever care is needed.*^™” In addition, the Care Connectivity Consortium 
(CCC) and the Sequoia Project believe patient privacy should be at the center of patient identity 
management strategies. Specifically, they want to help advance the ability of patients to protect the 
confidentiality and integrity of their data, and to help patients stay aware of and in control of their data. 
CCC spells out three principles to achieve these goals: (1) allow for anonymous or pseudonymous patient 
identities; (2) correct identification of patients so that their privacy preferences can be determined and 
honored; and (3) enable correct matching of patients to their records (whether anonymous or identifiable). 

The potential benefits of successfully matching a patient to their health information across all care 
settings cannot be undemtated. It is critical to health information interoperability efforts, critical to 
provide a patient a comprehensive health record upon request, and critical to ensuring that health 
professionals have the information to safely and effectively treat patients. More effective patient 
matching cc>uld lower healthcare costs by preventing redundant tests and scans, and more effectively 
prevent adverse events caused by medication interactions. The private sector has taken steps forward to 
reach these goals, but federal legislators need to facilitate government cooperation in ensuring success in 
building this infrastructure nationally. 

Harmonization of Federal Research Rules 

Similarly, federal rules for human subjects research, combined with other privacy rules, create a complex 
and burdensome enwonment for research. For example, definitions between the HIPAA Privacy Rule 
and the Common Rule for human subjects research are not always consistent, creating ambiguity and 
confusion for researchers. There should be one harmonized privacy standard for research institutions so 
that research and innovation are not delayed. The federal government should streamline the internal 
review board (IRB) process, clarify researcher and IRB expectations with respect to the scope and 
intensity of IRB review, and focus IRB resources and attention on those studies warranting the most 
careful scrutiny. 

Health Information Flow Recommendations 

In summary, there are several core needs that currently stand as barriers to fully integrating the use of 
health infonnation into a learning, interoperable health system: 

a Create a single national definition for protected health infonnation and privacy standard to protect 
patients while mitigating complications from state laws, 
s Update and harmonize federal privacy rules with regard to new and innovative research to allow for 
simple, clear requirements for health organizations - many of whom conduct research and drive 
innovation while providing care. 

» Support and cooperate with leading private sector organizations in their efforts to match the right 
patient to the right record with minimal time and effort. 
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In this dynamic environment of information sharing, stakeholders have gro«'ing concerns about open 
access to data and sharing data among and across providers because of the fear of breaching data 
confidentiality. Varying interpretations of HIPAA as well as different state privacy laws are also leading 
to confusion and a fear of violating the rules which is then resulting in restrictions to the movement and 
sharing of data. In addition, a growing number of data breaches are leading major health systems to be 
more cautious about sharing data. Building on these concerns, NDHI supports the need to review and 
simplify the complex web of laws regulating health information in light of the movement towards value 
based care and other information-based changes to the healthcare environment. 

FDA Rsguiations 

Manufacturers face unnecessary and redundant regulations from the FDA that delay access to 
breakthrough treatments and technologies. Various policies within the FDA’s purview have facilitated 
delays in both the approval of and access to innovative medical technology and treatments. Encouraging 
policy change that streamlines FDA’s responsibilities, while ensuring that companies are accountable, 
could reduce FDA’s workload, allowing it to focus on higher-priority activities, and would represent a 
significant cost and time saving for the private sector and the federal government. 

NDHI identified a series of unnecessary and redundant regulations from the FDA that delay access to 
innovative treatments and technologies. Addressing these barriers will help promote the development and 
availability of breakthrough treatments and technologies: 

• Reduce Regulatory Burdens on Mulficenter Clinical Trials - Eliminate the prohibition on using a 
single IRB of record for device trials, conforming the statute to the requirements for drug trials and 
the practice for other types of multicenter trials, and require FDA to develop guidance on the use of 
such single IRBs in device trials. 

■ Reduce FDA Premarket Submission Rule - Reduce the review burden on FDA and companies by 
allowing companies to make certain changes to devices without a premarket submission if their 
quality system has been certified as capable of evaluating such changes. 

s Recognition of Standards - Timely review of a request for recognition of a standard established by 
an internationally or nationally recognized standards organization would improve regulatory 
efficiency. Through greater use of standards and more transparency in this area, FDA review will be 
more efficient and the time to bring medical technology from the bench to the bedside will be 
reduced. 

» Valid Scientific Evidence - Expanding valid scientific evidence to include evidence described in 
well-documented case histories, including registry data, studies published in peer-reviewed journals, 
and data collected in countries outside the U.S. would allow greater flexibility in the FDA review of 
medical devices and improve access to new therapies for patients (Cures Section 2222). 

■ Training and Implementation of Least Burdensome - Training related to the meaning and 
implementation of the least burdensome provisions would increase efficiency and consistency for the 
FDA and manufacturers, allowing greater innovation for patients. Improved understanding and use of 
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the least burdensome provisions would minimize the time involved in bringing new treatments to 
patients, while maintaining FDA’s high standards for safety and efficacy (Cures Section 2223). 
m Increase flexibility to share scientific and healthcare economic information with population 
health decision-makers -Biopharmaceutical manufacturers can and should partner with payers and 
providers in efforts to communicate about and optimize the clinical benefits of prescribed treatments. 
The push for value-based payment is accelerating demands by payers and providers for a growing 
range o f information about the clinical and economic outcomes of their products. Biopharmaceutical 
companies routinely develop data describing the cost-effectiveness of various treatment options, data 
based on post-market use of these medicines, as well as safety and efficacy information. Application 
of these data can enhance patient care and the efficiency of the healthcare system, but companies are 
not cunently permitted to share such information proactively with healthcare professionals or payers. 

Table 6 in Appendix A provides more detailed descriptions of these issues. 


Conclusions 

NDHI reco^;nizes that these FDA regulatory barriers are all addressed in some way through the House 21“ 
Century Cures effort. The bill would provide additional resources to the NIH and to the FDA and 
benefits patients, researchers, and clinicians by supporting new opportunities for breakthrough treatments 
and cures. The bill is also designed to remove unnecessary regulatory burdens with an emphasis on 
patient centered research and care and break down barriers among healthcare silos to promote innovation 
and communication among researchers, scientists, and innovators. Finally, the bill includes an 
accelerated pathway for FDA approval and Medicare and Medicaid coverage for products that represent 
significant improvements in treatment or diagnosis of life-threatening or irreversibly debilitating diseases 
or conditions that would stimulate development of new diagnostics and treatments and assure prompt 
availability of those treatments to patients. NDHI will continue to address and support these issues in the 
Senate and through other opportunities as they arise. 
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Conclusion 




There is a broad consensus in the United States among healthc?are providers, payers, clinicians, patients, 
and consumers that the nation's healthcare system does not operate at a level that generates optimal value. 
There is significant room for improvement in elevating quality, cost-efficiency, and sustainability. There 
is a gap between the innovations being developed in all s^tore of healthcare and the ability to deliver 
those improved products and practices to pati«its. 

Through the Healthcare Leadei^hip Council’s National Dialogue for Healthcare Innovation initiative, 
companies from all sectors of healthcare joined with leaders of patient advocacy organizations, federal 
government officials, and academic health policy experts to build consensus on a broad spectrum of steps 
necessary to strengthen health system value and enable health innovation to have a greater positive impact 
on the entirety of the healthcare continuum. 

NDHI participants came to the conclusion that healthcare in the U.S. can be significantly improved by 
focusing on actions that are readily achievable via legislation, regulation, or voluntary actions by various 
health system players. Positive health system transformation does not require a wiiolesale remaking of 
health delivery structures, but rather the enabling and acceleration of patient-centered innovation. 

The recommendations in this paper are intended to drive health system transformation and a movement 
toward value and innovation. The consensus viewpoints contained in this report are also consistent with 
steps currently being taken by the federal government to guide a health system transition fi'om fee-for- 
service to pay-for-value and toward more integrated, coordinated care. These recommendations should 
serve as a catalyst for further debate and decisive action. 
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Mr. Hurd. Thank you, sir. 

Mr. Savage, you are recognized for 5 minutes. 

STATEMENT OF MARK SAVAGE 

Mr. Savage. Good afternoon. Chairman Hurd, Ranking Members 
Lieu and Cartwright, and distinguished committee members. 
Thank you for the opportunity to testify today. 

I am Mark Savage, director of health IT at the National Partner- 
ship for Women and Families, a nonprofit, nonpartisan organiza- 
tion that for 45 years has worked to improve the lives of women 
and families. We are deeply invested in improving the value and 
experience of health care and ensuring that new models of delivery 
and payment help make consumers partners in their care with ac- 
cess to the right care at the right time. 

I am delighted to be able to share today the values, experiences, 
and needs of patients and consumers who are using health infor- 
mation technology, such as online access and electronic data-shar- 
ing with doctors to improve their health and care. 

The national partnership leads the Consumer Partnership for 
eHealth coalition and can speak broadly to the great opportunities 
that health IT presents and the obstacles that still make it difficult 
to realize its full potential. 

Health IT is the essential infrastructure for improving quality, 
care coordination, and value in our health care system today. 

It is a critical tool for engaging consumers who clearly recognize 
its value, according to a national survey we commissioned in 2014. 
We found that nearly 9 in 10 patients with online access to their 
health information use it. Notably, people who use online access 
frequently are much more likely than infrequent users to report 
that health IT motivates them to improve their health. 

Patients recognize that health IT is essential to improving their 
access to care, as well as their access to their health information. 
They know what we know, that health IT helps patients and family 
caregivers communicate with their health care providers, share in- 
formation and manage their care; improves patients’ knowledge of 
their health and empowers them to take charge of their care plans; 
allows patients to correct errors or outdated information in their 
medical records, such as a missing drug allergy; enables patients 
to share treatment outcomes, such as pain levels, functional status, 
and whether their health improved after the office visit; helps 
health care providers answer questions from patients by secure 
email and provide care with telehealth and see the patients who 
need the most; gives patients more control over how much personal 
medical information is shared and how it is used; and much, much 
more. 

Like electronic access in so many other parts of our lives, such 
as banking and retail, health IT enables real-time access to care 
and information, and provides individuals with the convenience 
and control they need and expect in the 21st century. Health IT 
can also enhance patient trust and the privacy and security of pa- 
tient data through encryption and other means. 

The country has seen a rapid increase in health care providers’ 
adoption and use of health IT in recent years, but much work re- 
mains before the potential benefits reach all patients. We have an 
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urgent imperative to break down barriers and continue the 
progress. 

First, that begins with removing barriers to health information. 
The national partnership runs the Get My Health Data campaign, 
and, through it, we have learned that many patients continue to 
face astonishing barriers to getting their digital health records 
from their health care providers. We need to change that by ad- 
vancing policies and programs that promote patients’ online access 
to and use of their health information. 

Second, we need to clarify privacy and security requirements for 
sharing health data, because confusion persists about patient ac- 
cess rights. That means, for example, adding proactive education 
initiatives about what HIPAA requires and what it does not, and 
encouraging mobile app developers and technology vendors to post 
their privacy policies and data-sharing practices in standardized 
ways. 

Third, we need to enhance the usability of health information so 
that when patients access their medical data, they can understand 
and use it. For example, innovative apps could help patients orga- 
nize their health information in ways that they find most useful. 

And fourth, we need to bridge existing digital divides to help 
identify and reduce disparities in care. That means, for example, 
promoting online access to health information across diverse com- 
munities, and innovation in mobile apps can help. 

In sum, patients and consumers applaud the progress to date 
and they need more. Patients have a unique vantage point for they 
are at the center of the health care and information-sharing we are 
all working to improve. 

Our goal must be to leverage health IT so it helps patients be- 
come real partners in their care and health. Only if we do that will 
we realize the full promise of health information technology. Thank 
you very much. 

[Prepared statement of Mr. Savage follows:] 
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Today, I am here to speak to the great opportuihties that health IT presents to help patients 
and family caregivers partner with their health care providers to improve care, and to the 
remaining obstacles to realizing the full potential of an electronic health ecosystem. 

Why Health IT Matters to Patients and Consumers 

Inuprovino the Quality and Value of Care 

Electronic health information exchange is fundamental to improving quality, care 
coordination and value for our health care system. New models of care require the ability 
not just to share data, but to integrate relevant individual and population data across 
various sources (e.g. doctors, hospitals, laboratories, pharmacies, registries and patients). 

Patients likewise recognize and value the great benefits of health IT to their clinical care. 
According to a nationwide survey released by the National Partnership in December 2014, 
patients overwhelmingly believe that electronic health records (EHRs) are essential to 
making sure providers have timely access to information that can help avoid medical errors 
and repeat tests.* 

Enaaaino Patients as Partners in their Care 

Consumers experience significant direct benefits from the use of health IT, Health IT can 
make it easier for patients and their family caregivers to access care and information, 
navigate the health system, and communicate with their providers to better manage their own 
health or care for a loved one. 

Health IT is a critical tool for engaging patients in ways that empower them to 
partner in their health and care. Technology facilitates patient access to their medical 
information so they and their families can make informed decisions, in partnership with 
their care providers, about treatment and health that reflect their needs, values and 
preferences. 

Like electronic access in so many other parts of our hves, such as banking and retail, health 
IT enables real-time access to care and information, providing individuals with the 
convenience and control they need and expect in the 21=* century. 

• Access to CARE; Health IT transforms the environment, expanding patient access to 
care from what, for many, was access only during the occasional lO-minute office visit 
to access to care anytime and anywhere needed. For example, the effective use of 
telehealth services could improve access to care and enhance timely treatment and 
support. Telehealth is just one example of innovation in health information 
technology that can support patients and families in their own health and care. 


' National Partnership for Women & Families, Engaging Palienis and Families: Hov/ Consumers i'alue and Use 
Health IT (Dec. 2014), available at htti) :.*/www.nationalDartnership.org/research-iibrare'health-carei'HIT/engaeing- 
patients-and-families.pdf . 
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• Access to INFORMATION: Online access to health information helps patients and 
family caregivervS do things like share in£>nnatk}n with their providers and manage 
their care across multiple doctors. For example, health IT makes it possible for a 
patient who needs surgery to send her test results to another doctor for a second 
opinion. Or a daughter or son caring for parents in another state can keep up-to-date 
on their medications and treatment recommendations, with health IT. 

Patients already recognize and value these benefits. That’s why almost nine in 10 patients 
who have such access use it. Online access to health information can also help patients set 
and achieve personal health and wellness goals, which is particularly important for those 
managing chronic health conditions. Notably, people who use online access to their 
health information more frequently are much more likely than infrequent users 
to report that it motivates them to improve their health. 


Digitai Tools that Help Patients and their Providers 


Improving Communication and Coordination 


Online access to health information improves patients’ ability to communicate w'ith their 
doctors and improves their knowledge of their health, according to our national survey. 
Secure email messaging enables patients to communicate with their doctors in timely and 
efficient ways; to correct inaccurate or outdated information; and to share treatment 
outcomes, such as pain levels and functional status. 


In addition to promoting safe and appropriate care, electronic communication can benefit 
providers as well as patients by offering more efficient means to address patients’ and 
caregivers’ questions and concerns electronically, allowing more in-person interaction with 
providers for patients who need it most. 


One program that has helped significantly to bring online 
access and timely two-way information sharing to patients 
across the county is the Electronic Health Record 
(“Meaningful Use”) Incentive Program. In 2017-2018, 

Stage 3 will provide critical new tools to support 
coordination and interoperability between patients and 
their providers — for example, access through Application 
Programming Interfaces (APIs) so that patients can access 
and coordinate their health data with new tools such as 
smartphone applications (apps) and other devices. 
Private-sector innovators can develop new apps that make 
patient health data more accessible and useful to patients 
and providers alike. 


The National Partnership asked people to 
^re in Just six words why all patients need 
easy online access to health information and 
secure ways to email their doctors. People 
across America shared their six-word stories. 
Here are three: 

• "Second opinions matter. 
Information prevents redoing." 

Kathryn B., California 

• "Had cancer. Information 
helpful Removed doubt." 

Debbie G., Illinois 


• "Shared accurate records save 
patients' lives." 

Eloise D., Pennsyivsuva 
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Enhancing Privacy Protections 

A foundation of strong security and privacy protections is essential to public trust and the 
ultimate success of health IT. While people continue to be concerned about the privacy of 
their health information, those concerns are increasingly understood in the fuUer context of 
the benefit of EHRs and electronic health information exchange. Indeed, health IT provides 
opportunities for enhancing the privacy and security of patient data, including encryption of 
electronic personal health information and electronic audit trails. 

Health IT can also give patients more control over how their personal medical information 
is used. Different people may deem different kinds of health information to be especially 
sensitive, such as psychotherapy notes or substance abuse information. Continued 
development and testing of approaches that enable patients to segment their data and 
direct which care team members can see certain information can enhance consumer trust 
and use of electronic health information exchange. 

Patients’ online access to their health information can also improve trust. Our survey found 
that patients who use online access more frequently have significantly greater trust that 
their providers will protect their privacy and other rights than patients who use online 
access infrequently or never use it. Accessing and seeing one’s electronic medical 
information is a significant factor in increasing patients’ trust that their information is safe 
and that their doctors are protecting their privacy. 

Key Actions to Leverage Health IT and Improve Health Care 

The country has made substantial progress in the past few years, including a rapid increase 
in adoption and use of certified electronic health records (97 percent of hospitals, and 74 
percent of office-based physicians through 2014^). For patients, their online access to their 
health information has doubled in three years, increasing from 26 percent in 2011 to 50 
percent in 2014, according to our national survey. This adds up to profound and very 
welcome change. However, much more work remains before the benefits and opportunities 
of health IT will reach aU patients. 

To move to a system where patients’ access to and use of their health care 
information is the norm, we must break down barriers on a variety of fronts. None of 
these actions require legislation; they can be done through federal guidance or assistance 
that further spurs private sector innovation, by public-private collaboration and by industry 
advancements. The following recommendations reflect what we have heard from consumers 
across the nation about their experiences getting and using their health information. 

(1) Address barriers to access to important health information 

Consistent with our commitment to improve consumer and patient access to their 
health information, we worked with leading technology, consumer and provider 
organizations to convene the GetMyHealthData campaign. OetMyHealthData is 


- Office of the National Coordinator for Health Information Technology, Report to Congress on the Adoption of 
Health Information Technology and Related Efforts to Facilitate the Electronic Use and Exchange of Health 
Information (Feb. 2016), pp. 27-28. 
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dedicated to making it easier for patients and families to request their medical records 
and other health information, and to use their data to improve their care and health. 

In leading the campaign, the National Partnership has learned a lot about what the 
process of getting and using health data is like in the real world. We have learned from 
our volunteers that, despite longstanding policies designed to improve access to health 
information, patients continue to face many banders to getting electronic copies of their 
medical records and other health data. Too often: 

• Accessing health information is a confusing and difficult process for patients. 

• Confosion surrounding HIPAA persists, and both providers and patients 
misunderstand patients’ rights to access their health information. This often 
means that patients do not get the access to information they need for 
themselves or a loved one, despite their rights to their health data. 

• Unreasonable fees for copies of health records pose barriers to patient access, 
further impeding their ability to get and use their health data. 

Accordingly, the campaign has worked to bridge these gaps by developing innovative 
tools and guidance to make it easier for patients and families to request access to and 
use their health information. 

Key actions to remove barriers to access: 

• Public and private-sector efforts need to advance policies and practices that 
promote patients' online access to and use of their health information. 

• Public and private-sector efforts to address interoperability among health IT 
systems and users must explicitly include consumers as equal users and 
address operational and technical barriers that impede the ability of patients 
and family caregivers to send, receive, find and use their health data. 

(2) Clarify privacy and security requirements for sharing health data 

One significant point of friction in patients’ access to their health information is 
providers’ and patients’ misunderstanding of patients’ access rights. 

Key actions to clarify privacy and security requirements: 

• Policies to promote patient access must be supplemented with comprehensive 
and proactive education initiatives to enhance understanding of patients’ 
rights to their electronic health information and providers’ responsibilities 
when responding to patient requests. 

• Mobile app developers and other technology vendors should join voluntary 
efforts to post their privacy policies and data sharing practices embedded in 
their products in standardized ways. This wiU help consumers quickly and 
easily compare such policies and practices (such as whether the developer 
sells consumer data for marketing or pharmaceutical research). 

{3} Enhance the Usabili^ of Access to Health Information 

Even when patients can access their medical data, the data may be difficult to 
interpret, use and translate into meaningful and actionable information that can 
inform their care or the care of loved ones. Does a particular blood test value mean 
that one is healthy or that one needs care? Health data often need context, 
explanation or interpretation to help consumers understand their meaning. 
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Key actions to improve usability: 

• Public and private entities, including tecbnology and app developers, should 
work together to improve the usability of patient health data so that, for 
example, consumers and patients can incorporate their data into apps that 
display the data in formats and with options that consumers find meaningful, 
useful and actionable. 

(4) Bridge the Digital Divide 

Barriers to electronically connected and coordinated care tend to he even greater, for 
example, in rural and undersei-ved commrmities, and for the 60 million Americans 
with disabilities and the 60 million who speak languages other than English. We 
need to design and build digital health tools for patients that reflect their diverse 
needs and bridge existing digital divides. 

Key actions to bridge digital divides: 

• The public and private sectors should improve and promote online access to 
patient health information across aU communities, and remove the barriers 
that impede access and use for too many people today. Innovation in mobile 
apps can help. The more consumers across diverse communities can share 
information that reflects their needs and experiences, the greater potential 
we have to identify and ultimately reduce disparities in care. Additionally, 
public-private partnerships are an important component of increasing 
broadband adoption. 

Patients have a unique vantage point: They see multiple providers and thus know 
whether their care is being coordinated. They know whether they have to provide the same 
information over and over again, or whether tests have to be repeated because the results 
were lost or inaccessible. They can spot and correct errors in their medical records. They 
know and can report the many factors outside the clinical setting that are integral parts of 
their health and care, such as the family caregivers who assist them, the community 
resources they access and the social determinants that affect their health. Taking the 
steps described above, we can leverage health IT to enable patients to contribute 
all of these critical resources as partners in their care. 
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Mr. Hurd. Thank you, Mr. Savage. 

We are going to keep going. We are expecting votes in about 10 
to 15 minutes, so we will try to get through as many members’ 
questions as we can. 

To kick us off this afternoon is the distinguished gentleman from 
North Carolina, Mr. Walker. 

Mr. Walker. I thank you, Mr. Chairman. 

I appreciate the panel being here today and taking your time and 
being really a valuable resource for us. 

I married into the medical community. My wife is a family nurse 
practitioner at Wake Forest Baptist Medical Health Center. Every 
time I feel like I have, by osmosis, learned more medical knowl- 
edge, after 23 years, she reminds me that I don’t really have a good 
base of understanding. 

But this is something that concerns. I remember even as a min- 
ister for 2 decades sometimes trying to get information about a pa- 
tient to family members or to others, and trying to figure out how 
we can meet those needs. Sometimes there were problems to do 
that, even good laws. 

I also want to paint a picture here of some friends. I recently 
tagged along with a surgeon there in Moses Cone Hospital in 
Greensboro that has been so burdened with some of the software 
and some of the regulation. It has impacted him negatively, as well 
as other physicians who have talked about this. 

So I want to address a couple of these issues. Maybe, Mr. 
DeCrescenzo, if I could start with you, you both mentioned in your 
testimony obstacles. You also mentioned the word “barriers.” Talk 
to me for just a minute, if you would, about what specifically are 
the obstacles and barriers to getting where this needs to go. 

Mr. DeCrescenzo. I think some of the barriers and obstacles. 
Representative, are some of the things that I mentioned and some 
of the other folks here on the panel. 

First of all, there is a lot of activity underway around collabora- 
tion in the industry, but it is one that we think needs to be sup- 
ported broadly. We have both private sector and combined private 
sector and government initiatives, things like the CommonWell Al- 
liance, the Sequoia Project. There are technical standards from 
committees like HL7 that are trying to push the ball forward to 
make these systems talk to themselves, to each other, a lot more 
adeptly and easily than they have historically. 

I think support for that, as exhibited by the ONC report that 
came out last year, to push us down a roadmap where those efforts 
can be channeled into a way that they ultimately come to a har- 
monized approach between the State regulations and laws and 
standards. Federal, State, Federal laws, regulations, and stand- 
ards, and private sector initiative, really is one of the ways that we 
can make the most against some of the obstacles and barriers that 
exist today where the systems don’t have those standards to make 
it easier for them to talk to one another. 

Mr. Walker. Thank you for responding to that. Are you familiar 
with the Press Ganey scores? 

Mr. DeCrescenzo. The patient satisfaction scores. 

Mr. Walker. Exactly right. I want to make sure that we are also 
being an advocate for the health care providers, that we don’t put 



135 


these guys in a bind. In fact, earlier this morning, we had a very 
passionate hearing — compassionate, I should say as well — as far as 
the heroin and opioids. And we know sometimes patients can be 
very manipulative in this process. 

Can you take a moment. Dr. DeSalvo, and speak to that to make 
sure, as we move forward with this, we are not putting our pro- 
viders in a more vulnerable position? 

Dr. DeSalvo. Thank you for the question. Congressman. 

As a doctor, I know full well the challenges of making sure that 
you are being compassionate but also being evidence-based in the 
practice of medicine. 

I wanted to touch on the patient access piece, because you men- 
tioned it, and it is so critically important. The electronic health in- 
formation is theirs. They have the right to access it. And we have 
worked with the private sector to see that we are creating innova- 
tive ways that they have more ready access to that information, so 
they can make their own care decisions, but also it can be available 
in the care setting. 

As an example, just in the last few months, working with the Of- 
fice of Civil Rights, who has the primary responsibility for HIPAA 
access, put out some guidance directed at consumers, so that they 
would know what they have the right to access. This is a common 
refrain that we hear from consumers but also from docs who want 
to make sure that the information is getting out. 

In the space of opioids, as an example, we certainly want to 
make sure that we are doing everything to support clinicians on 
the frontlines. 

My husband is an emergency medicine doctor, so this is a very 
everyday occurrence for him. The tools like PDMPs, the prescrip- 
tion drug monitoring programs that are electronic in many States 
and have really made it easier for us to access information to make 
sure that we are appropriately giving opioids to people who have 
pain, are needed, but also trying to help folks stay out of trouble. 

We have been working with SAMHSA and with States and with 
the industry to see that those become more aligned within elec- 
tronic health records, so you don’t have to go to another place and 
sign on. That’s an added burden. 

Mr. Walker. Before my time expires, let me also look at this. 
Health care certainly is very important as we move forward in hav- 
ing the right perspective. As a Member of Congress, we also have 
a financial fiscal responsibility as well. We spend more than $2,000 
per patient than any other country in the world. 

Can we make a case out of this that is something that can drive 
us to be more health care cost conscience as well? 

Mr. Quinn or Ms. Rich, would one of you like to address that? 

Mr. Quinn. I will use as an example Intel’s Connected Care pro- 
gram. Where Intel, as a large purchaser of health care on behalf 
of its 53,000 employees in the U.S., said how can we make our em- 
ployees the healthiest in the country, retain them, and also try to 
save some money doing it? 

We have been very successful in the first two. The third has been 
more challenging, although there has been a great progress there. 

The key to it, I would say, and this is also the key potentially 
for driving data-sharing and information-sharing in our broader 
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health care system, is focusing on value-based care, rather than 
fee-for-service. That was the engine that drove this, and we have 
seen a massive amount of actual use of this health information ex- 
change because, of course, the technical pieces are there with the 
Sequoia Project and building this, but also the incentives for using 
it are there for the health care providers. 

Mr. Walker. Thank you, Mr. Quinn. 

I yield back, Mr. Chairman. 

Mr. Hurd. The plan is to go to Mr. Connolly, and then we will 
go into recess to get to votes. 

I now recognize the gentleman from Virginia, Mr. Connolly, for 
5 minutes. 

Mr. Connolly. I thank the chair. 

And I thank Mr. Lieu and Mr. Cartwright for their gracious con- 
sideration. Thank you so much. I have seven hearings in a day and 
half, so I’m running back and forth. 

Mr. Quinn, thank you for sharing your story. Boy, could I relate 
to that. Both of my parents are in their 80s, and I have witnessed 
scenes where one is in the hospital in the emergency room, and the 
other one is being asked to give the history, the medical history. 
I’m thinking, what could go wrong with this scenario? Thank God 
they are both alert and have mental acuity, but you know, memory 
sometimes fails us in moments of stress. 

It is hardly an ideal system, and surely technology exists that 
would allow us to have a comprehensive picture of the patient in 
question without relying on human memory and such. 

So I really related to what you had to say, and I hope your dad 
is doing well. 

Dr. DeSalvo, picking up on Mr. Quinn’s narrative, according to 
HHS’s 2016 report to Congress on the adoption of health IT, your 
agency found that 97 percent of hospitals and 74 percent of physi- 
cians possessed a certified electronic health record system. But only 
76 percent of hospitals and 42 percent of physicians with electronic 
health record systems were sharing the information for the coordi- 
nation of care. Why that big gap? 

Dr. DeSalvo. Well, thank you for the question. I certainly identi- 
fied with Mr. Quinn also, both as a doctor who takes care of those 
kinds of patients but also because of family members as well. So 
as I said in my opening, it is pretty personal to all of us to see that 
the data is moving. 

The good news story in the data that you present is that, over 
the course of the last many years, we have dramatically increased 
not just adoption but the opportunity to move and share data. So 
those are snapshot numbers. But if you look back at the trajectory, 
every year it improves both for doctor offices and hospitals. We are 
not where we want to be yet, but we are making progress. 

There are areas like the national capital region where health in- 
formation exchanges like CRISP make that data available, such 
that if somebody arrives in an emergency room, their primary care 
doc will get a ping and be able to have the opportunity to send that 
med list or problem list, so that we will actually know more about 
the person in the ER. 

There are even more exciting advances happening, like in Mis- 
sissippi, where the State of Mississippi has been working with local 



137 


vendors to see that all of long-term data from their Medicaid pro- 
gram is available to the doctors in the University of Mississippi 
Medical Center, so that when somebody arrives, you have a picture 
like you mentioned. 

Mr. Connolly. You mentioned CRISP, but doesn’t that require 
a voluntary decision to participate? 

Dr. DeSalvo. You are touching on the challenge that has 
emerged since we have been adopting electronic health records and 
moving to a digitized system, and that is that State laws vary, and 
so there is a need to harmonize that. 

Mr. Connolly. Right. That is a particular challenge here in the 
national capital region, since we have three jurisdictions with three 
different political cultures and sets of laws and so forth. 

I have actually encountered that, where Maryland has one set of 
standards on this kind of communication and Virginia has another, 
and we are not always talking, which what could go wrong with 
that for someone’s health? I mean, you could jeopardize someone’s 
health without intending to. 

Now, do we need, from your point of view, and I welcome Ms. 
Rich as well, or anyone else, but is this a case where, frankly, we 
do need to look at some Federal legislation? 

We regulate blood supply for safety. Well, electronic record- 
keeping is not just a nice thing to have. In the digital age, it may 
be very critical to someone’s health and the care they get, espe- 
cially in an emergent situation. 

Dr. DeSalvo. In the short run, we have been working, the Office 
of National Coordinator, with the National Governors Association 
on developing a toolkit so States themselves can harmonize their 
privacy expectations, so that won’t be an unnatural impediment to 
information flow. 

Over the long term, clearly, the health IT landscape has changed 
a lot since HITECH was passed in 2009. We were on iOS 3 then 
and now we are up to 6, just as one example. But apps and cloud 
computing have really evolved. 

So we certainly are leveraging all the opportunities that we have 
at ONC and our partners, the Office of Civil Rights and other agen- 
cies, to see that we are protecting consumers and that data is going 
to flow. But there are areas where we know that there may be 
some opportunity, like information-blocking, where we would need 
some additional support. 

Mr. Connolly. Thank you so much for this fascinating conversa- 
tion. 

Again, Mr. Chairman, thank you. 

Mr. Hurd. Sure. 

Votes have been called. The committee stands in recess until im- 
mediately following votes. 

[Recess.] 

Mr. Hurd. The Committee on Oversight and Government Reform 
Subcommittees on Information Technology and Health Care, Bene- 
fits, and Administrative Rules will get started again. 

I appreciate our witnesses’ and guests’ patience as we went to go 
vote. We shouldn’t be interrupted. 

To get us restarted is my friend from California, Mr. Lieu. You 
are recognized for 5 minutes. 
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Mr. Lieu. Thank you, Mr. Chair. 

Dr. DeSalvo, in your opening statement, you mentioned data- 
blocking. Can you explain what that is and how it works? 

Dr. DeSalvo. Yes, certainly, Mr. Lieu. Thank you for the ques- 
tion. 

Congress asked us to provide a report on health information- 
blocking, which we did last April. We thank you for that, because 
it generated a national conversation and set into motion some ac- 
tions that we have been taking in partnership, for example, with 
the Office of Inspector General, also with the Office of Civil Rights, 
to see that we unblock data that has been collected in electronic 
health records. 

This is a new challenge we wouldn’t have had years ago when 
we did not have a digitized system. It has emerged since 2009 
when the HITECH Act put ONC and our authorities into place. 

An example of it would be that I’m in a health system and my 
patient records have been collected or digitized, and a patient ends 
up in the emergency room at another hospital across the street, 
and for whatever reason I’m not sure I can share it, because I don’t 
understand HIPAA, or maybe I don’t have a business associate de- 
gree that I think you need to have to share data. And so when that 
patient shows up across the street literally, the data is not moving. 
And it is just because of a lack of understanding. 

So that would be sort of an unknowing example. And by edu- 
cating about HIPAA, which is something we have been actively 
doing, we hope to unblock that sort of data. 

Sometimes it is more around business practices. People want to 
hold onto patients or hold onto data and don’t share it. 

So we have asked and gotten pledges from the health IT industry 
to say they won’t block data. Now we are acting on making sure 
that we can put some teeth to it. 

But if I may. Congressman, it is an area where, since 2009, the 
world has really evolved. That is why in our budget request, we did 
put forward a proposal asking for some more opportunities for us 
to be able to address blocking, and to see that, where data could 
move, that it would. 

We really welcome the chance to talk with you more about the 
ways that we think we could have more opportunities to address 
it. 

Mr. Lieu. Just so I understand, sometimes you have data-block- 
ing because the doctor or hospital may not have interpreted HIPAA 
correctly. Are there times where, in your opinion, they are inten- 
tionally doing it to gain a competitive advantage? 

Dr. DeSalvo. We certainly heard plenty of reports about the use 
of it to gain a competitive advantage. 

Mr. Lieu. What about vendors? Do vendors sometimes do that as 
well? 

Dr. DeSalvo. Occasionally. The way that will occur with vendors 
is they will require added fees, unexpected fees, to create the inter- 
faces, and that is a form of lack of transparency but can also be 
a form of blocking. 

Mr. Lieu. And in the HITECH law, do you believe there are gaps 
that could address this? What can this committee or Congress do 
to help on data-blocking? 
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Dr. DeSalvo. Yes, sir. 

What we have asked for as part of our budget request are some 
additional opportunities around defining it and giving us an oppor- 
tunity to require that vendors, for example, can’t use gag clauses 
to prevent providers from talking about some of the contractual ele- 
ments. Those are just a couple of the examples that we’ve asked 
for. 

So, yes, we do believe that, since the world has evolved, there is 
a new need for us to have some additional opportunities to protect 
the people who are using the systems and, more importantly, to 
protect the data of the consumers. 

Mr. Lieu. Let me switch to cybersecurity. 

Hollywood Presbyterian Hospital in Southern California had 
been attacked with malware. They had to give a ransom to get 
their data essentially unencrypted, unblocked. Two more hospitals, 
it was disclosed, were recently attacked in Southern California. 

What do you think we can do to help prevent those attacks? 

And my understanding is that it is the Office of Civil Rights that 
does cybersecurity? 

Dr. DeSalvo. That’s correct. 

Mr. Lieu. And do you think that would be the appropriate office 
or not? 

Dr. DeSalvo. The Office of Civil Rights does have the primary 
responsibility for privacy and security, and for security breach in- 
vestigations. We work with them in a variety of ways to see that 
we are educating providers, clinicians, and others to make sure 
that the functionalities, the capabilities in electronic health records 
that we require to keep the data secure, are actually used in the 
field. 

We all know that there is a mix of both physical and 
cybersecurity expectations, so tools like our security risk assess- 
ment tool is a way that we educate providers to know in a simple 
way how they can protect the data that is in there. So there are 
some opportunities that we leverage, but we work largely in part- 
nership with the Office of Civil Rights. 

Mr. Lieu. And does that office have a team of computer folks 
that deal with cybersecurity issues? 

Dr. DeSalvo. It is very tight partnership. They certainly have 
experts in the area of HIPAA and cybersecurity and privacy, and 
we work very hand in hand with them. 

We, for example, recently released some additional guidance for 
providers but also for consumers about access and security, and 
have posted a series of joint blogs to make sure there is a shared 
understanding of what security expectations there are. 

You all, for example, asked the department to put together a 
cybersecurity task force, and we have been working along with oth- 
ers across the department to see that we put together that task 
force. It just met for the first time last week, so we thank you guys 
for raising that issue. 

Mr. Lieu. Thank you. I yield back. 

Mr. Hurd. I would like to pick up where Mr. Lieu left off. So in 
OCR, they have lawyers so they understand HIPAA. Do they have 
technical folks that can actually help with a breach or the next 
ransomware attack? 
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Dr. DeSalvo. Congressman, I would not want to speak specifi- 
cally to the skill sets of their staff. What I can share with you is 
that the Office of the National Coordinator, which has technical 
staff, partners very tightly with the Office of Civil Rights, just like 
we do with other agencies, to make sure that we are bringing that 
talent to the table if it is necessary. 

Part of this task force as an example, which is with the private 
sector, is to bring together the best minds in cybersecurity and to 
work with not only ONC but OCR to see that we are helping to 
advance the health care marketplace to adjust to any new changes 
they need to in cybersecurity. 

Mr. Hurd. Ms. Rich, why is there so much confusion around 
HIPAA? 

Ms. Rich. I can’t speak to why there is confusion around HIPAA, 
but I do know that there are many entities that are outside of 
HIPAA that are under our jurisdiction, and that includes all the 
health apps and the Web sites that take in consumer-generated in- 
formation, and that consumers may be confused about whether 
there is a regulation that protects their privacy in those areas, 
which is one of the reasons why we think there ought to be a regu- 
lation that protects the privacy and data security for the informa- 
tion collected by those entities directly from consumers. 

Mr. Hurd. Does FDA have responsibility in some type of regula- 
tion in this space? 

Ms. Rich. The FDA regulates medical devices, and that includes 
some health apps. But generally, they are looking at safety issues 
surrounding whether the app does what it says it does. The privacy 
and data security issues of such entities is generally in our care. 
And we have been working in this area for over 15 years, and we 
have an extensive program to look at the data security of these en- 
tities and take action — well, educate them to start with and then 
also take action in appropriate instances. 

Mr. Hurd. So if it is a HIPAA violation, that is OCR’s jurisdic- 
tion. If it is generally something else, it may be you, it may be 
FDA, it may be SAMHSA, or the PPACA. There are so many of 
these different regulatory bodies, and my fear is that it is hurting 
innovation. It is hurting the proverbial two guys or two gals in a 
garage from creating something that can change the way that we 
deliver health care. 

Ms. Rich, I will get back to you on another question. 

I wanted to ask Messrs. Quinn, DeCrescenzo, and Savage, and 
then, Ms. DeSalvo, you answer after them, meaningful use, this is 
a term that I have been hearing a lot over the last 16 months that 
I have been in Congress and how it was originally designed to kind 
of spur companies from participating in EHR programs. But what 
I am hearing is that it is actually getting in the way of innovation. 

I would like for you three gentlemen to comment on your opin- 
ions on meaningful use. And, Ms. DeSalvo, I will let you be the 
cleanup batter. 

Mr. Quinn? 

Mr. Quinn. So meaningful use was quite successful in driving 
adoption of electronic health records. Without meaningful use, we 
wouldn’t have the rates of adoption today that we see. 
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As is the case with my dad’s example, that each individual 
health care organization has an electronic health record and may 
he beginning to exchange data doesn’t mean that the net result of 
it is the coordinated care, the shared health information, that we 
all need. And the prescriptiveness of this led some vendors and 
health care organizations to play to the test. 

What we need is to think ahead about the next generation of 
technology that is needed to embrace, for example, the Internet of 
Things, consumer-generated health data, the data that is being un- 
earthed with the genome, and these other sources, and incorporate 
them into this so that we are not just thinking about this program 
as an end unto itself, but as an enabler of new technologies, new 
care models, et cetera. 

Mr. Hurd. Thank you. 

Mr. DeCrescenzo. Thank you, Mr. Chairman. I would certainly 
second Mr. Quinn’s opinion that meaningful use as it has been af- 
fected in the last few years to dramatically increase use of the 
EHRs, as Dr. DeSalvo mentioned earlier, in addition to some of the 
new technologies that you mentioned, need now to be considered, 
and also suggest that over the last 4 or 5 years under meaningful 
use, we have learned a lot about how technology is used and what 
are some of the other process and incentive issues, including things 
like reimbursement mechanisms that may or may not incent fur- 
ther use of electronic medical records and other types of electronic 
digitization of health information in a sharing around that. 

So going forward, we believe that we need to be thoughtful about 
what we have learned over the last 4 or 5 years, as we look at addi- 
tional regulation or requirements for expanding the use of elec- 
tronic medical records and allied technologies. 

Mr. Hurd. Mr. Savage? 

Mr. Savage. We agree that the meaningful use program has 
been a major catalyst for improved adoption and use of health IT. 
Patients have been seeing a lot of the benefit of that. As I said in 
my testimony, there are still obstacles to overcome, and more needs 
to be done. 

But with the meaningful use program in our surveys, we saw a 
doubling of online access from 2011 to 2014, from 26 percent of pa- 
tients with online access to 50 percent. 

We see them using it for the kinds of things that are really crit- 
ical for delivery system reform that is coming. So the access is im- 
portant, but the meaningful use program is also in 2017 to 2018 
to provide much more robust functions around patients sharing 
data with their providers, nonclinical data that is nonetheless rel- 
evant to care, better correction of errors, wearables, remote moni- 
toring. And it will, indeed, stimulate the kind of innovation that we 
are all looking for. 

The version that is coming up also has APIs. We have tech devel- 
opers who are writing apps for using those APIs. 

So important catalyst. Critical things are coming for patients and 
family caregivers to help them with their care planning. 

Dr. DeSalvo. Thanks to these folks. I’m just going to talk about 
going forward, because the health IT landscape and health care has 
absolutely been changing and evolving. We are looking to go for- 
ward after listening to providers, after seeing where the health IT 
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landscape is, to take the opportunity that was made from the doc 
fix or the MACRA legislation and make this program going forward 
more flexible, much more focused on clinical outcomes and on inter- 
operability. 

Mr. Hurd. Thank you. 

Mr. Cartwright, you are recognized for 5 minutes. 

Mr. Cartwright. Thank you. Chairman Hurd. 

I want to follow up that discussion with Mr. Savage a little bit. 
I think a cornerstone of the health IT field are the electronic health 
records, the digital version of a patient’s paper chart containing not 
just the patient’s current condition but also his or her medical his- 
tory. 

I have here, it looks like a Harris poll that NPWF commissioned. 
Is that correct, Mr. Savage? 

Mr. Savage. That is correct. 

Mr. Cartwright. So this is entitled, “Engaging Patients and 
Families: How Consumers Value and Use Health IT.” 

I will ask that this be made a part of the record, Mr. Chairman. 

Mr. Hurd. So moved. 

Mr. Cartwright. It is a result of the Harris poll. I cannot imag- 
ine how long this poll went, Mr. Savage, but it’s pretty hefty. 

It was done in the spring of 2014, correct? 

Mr. Savage. Correct. 

Mr. Cartwright. Toward the end of it, there is a global sum- 
mary. And it showed that more than 50 percent of patients want 
the ability to review their treatment plans, right? 

Mr. Savage. Correct. 

Mr. Cartwright. And that nearly 60 percent wanted to see their 
doctors’ notes, and that fully 75 percent of patients wanted access 
to their test results electronically. 

Have I got that correct, Mr. Savage? 

Mr. Savage. Yes, we found great interest in all of those. 

Mr. Cartwright. So that is the sort of information that would 
be available in an electronic health record, correct? 

Mr. Savage. Yes. 

Mr. Cartwright. Okay. Is it easy for patients to get access to 
their electronic health records right now? 

Mr. Savage. The survey that you are referencing does identify 
increased numbers of access, doubling from 26 percent to 50 per- 
cent. For those who have it, it has become easier, but the national 
partnership has also done work with the Get My Health Data cam- 
paign, which has found that there are also people without the ac- 
cess that they need and that there are some barriers. 

So I can either talk about on the survey side, or I can share with 
you some of the barriers we found with the Get My Health Data 
side. 

Mr. Cartwright. The barriers I’m interested in. 

Mr. Savage. We have tracers, volunteers who report to us their 
experience with trying to get data, and everybody’s story is unique. 
But we do find some commonalities among those stories. 

So some of the significant barriers are a very complex, time-con- 
suming process in order to get access. So you and I, in order to get 
access to our banking records, we just go down to an ATM or access 
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it through the Internet. That is not a time-consuming process, for 
the norm. 

But for access to health records, yes, it has been very time-con- 
suming for these individuals. 

Records provided in a format that is not useful. You may ask for 
it in an electronic format. You get a piece of paper by snail mail. 

Misunderstanding of what patient’s rights to access are. 

And perhaps one of the things that we’ve discovered most re- 
cently is the use of unreasonable fees in order to — before you can 
get access to your records. That may take the form of you have 
asked for your information and, sure, here’s the copy and here’s the 
bill, and it is a bill that you never expected. Surprise. Or you are 
charged a per page fee when it is an electronic record. 

So there’s actually been — the Get My Health Data campaign has 
recommended that there be some comprehensive education initia- 
tives to try to help providers and patients alike understand the re- 
quirements better. 

And the OCR guidance that recently came out provides some ex- 
amples of the kind of innovative education efforts that we really do 
need to see. 

Mr. Cartwright. Dr. DeSalvo, pick up from there. What kind of 
examples? 

Dr. DeSalvo. So consumers have more access to their informa- 
tion than they did previously, though it is not where we think it 
needs to be. And as Mr. Savage mentioned in his earlier comments, 
we have been pushing through the meaningful use program and 
through other ways to get increased consumer access. 

We, in fact, just put out a challenge grant through the Office of 
National Coordinator calling on the private sector to take advan- 
tage of this API expectation that we put in electronic health 
records to create very consumer-friendly apps that would be on a 
smart phone and allow somebody, any patient, to be able to access 
their health information and have more opportunity to control it. 
So we are really excited to see what the private sector is going to 
develop in the next few months to make it easier to get more ac- 
cess. 

The kinds of examples that get in the way of that, technology 
certainly Mr. Savage mentioned, but they are sometimes just a 
misunderstanding of HIPAA. The Congressman had asked earlier 
why doctors don’t understand HIPAA, and part of it is we are not 
really well-trained in it in medical school. 

This is, I think, a really important opportunity that the medical 
education field has along the way to see that we understand what 
HIPAA is and is not, and do not let it get in the way. Also, the 
way sometimes it is enacted gets in the way of consumers having 
access to their information. 

It is, in essence, a form of blocking. 

So, again, back to this comment of, the world has really evolved 
and now there is data to be free, data to move. And the primary 
concern is to see that it is there for that clinical moment when you 
need it. 

There are also many other important uses, so we are leveraging 
all the tools we have, whether that is education or clarity on rules 
and regs, but there’s probably also some additional needed atten- 
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tion and maybe some additional support to see that blocking is 
never a reason that people do not get their data. 

Mr. Cartwright. So last question, my sense of it is that the bet- 
ter access patients have to their medical records, the better we all 
are in terms of patient safety. 

Does anybody disagree with that? Let the record reflect they are 
all shaking their head no, Mr. Chairman, and I yield back. 

Mr. Hurd. Thank you, sir. 

I would now like to recognize Ms. Lujan Grisham for 5 minutes. 

Ms. Lujan Grisham. Thank you, Mr. Chairman. I think I prob- 
ably want to take off from where my colleague was leading you all, 
Mr. Cartwright. 

I actually think in addition to the blocking and misunder- 
standing that we have seen two principles in HIPAA be deter- 
mined — and as an attorney, I feel bad about this — but sort of a 
legal opinion that you have two mutually exclusive premises. One, 
patient protection, and the other would be the portability of that 
information, and they err on the side they are absolutely in their 
minds mutually exclusive, so they go to privacy. 

I just had this happen with a very large, very recently, health 
care provider who argued with me — and HIPAA, I spent a lot of 
time dealing with HIPAA, so it wasn’t — I won, because the CEO of 
the health care company refused to provide the patient information 
from provider to provider. 

Actually, I was trying to do them a favor, right? I have labs that 
are 45 days out. I get a patient who calls my office as a constituent 
and says I have to have them because my specialist can’t do what 
they need to do without the records from this other provider. I said, 
let me just call, because I know I don’t need really anything else, 
provider to provider, just do it. And basically I’m helping you, be- 
cause God forbid we find something in those labs that indicate to 
your lawyers that you have a real liability. 

And then second, they wouldn’t do it, because HIPAA prevents 
that, as you all know it absolutely does not. For the audience, it 
does not prevent that. It explicitly provides for that. 

Then in addition, to make it easy for them, I was willing to get 
the patient on the phone, with plenty of patient identifiers. And 
HIPAA, according to this provider, also explicitly prohibits not hav- 
ing someone where you have really restrictive proof that that is the 
patient. I said that is nowhere in there. That is your own system, 
which gets to that it is proprietary, it is not interoperable, and that 
while we are to doing I think great strides to make this informa- 
tion available, that unless we deal with that, you can’t really create 
a patient record. 

I have to have apps for, right now, let’s see. I’m old, that would 
work with about 47 different providers. Now that I am lucky 
enough to have this job, I have to have to add all the providers that 
are in D.C. that I guarantee you do not speak to any of my pro- 
viders in Albuquerque. 

So that was a typical-for-me, long-winded statement that our in- 
tentions here and meaningful use and all the incentives and includ- 
ing many of the accountability mechanisms really haven’t gotten us 
to what we really want, which is very effective patient records, be- 
cause if we want patients to be part of problem-solving, and you 



145 


do. If I get access to my record, I find all kinds of stuff that my 
docs didn’t see because they are busy. I feel bad about that. I love 
them. They are my docs, so I really like them, or my practitioners. 

But they do not have the time to search through stuff, which is 
why every time you go, they have to do a whole new history be- 
cause they have to ask me, because it is much faster. But what 
happens when about 20 years from now, I can’t remember for a 
whole variety of reasons? 

So what additional incentives can we use? And you sort of floated 
around many, right? 

But I also want a milestone check, because I have also been 
working on telehealth for more than 2 decades. Quite frankly, the 
reimbursement issues and the other barriers really simply have not 
made it available in the places where the technology, not only in 
juxtaposition to physician consultations or physician-to-patient con- 
sultations, but now you have the ability to do incredible online 
diagnostics. And yet, we aren’t really doing it. 

So what are some really great milestones and mechanisms that 
this committee can help you achieve, to that end? 

Anyone? All of you? Everyone? 

Ms. Rich. I would just like to comment that I do think an obsta- 
cle to uptake on the part of consumers is concern about privacy, an 
obstacle to uptake of use of electronic records. 

Regardless of what a lot of consumers think about privacy in 
other contexts, we do know that they care a lot about privacy when 
it comes to their health records, which can reveal truly personal in- 
formation. So from the perspective of somebody that is talking 
about privacy, we would like to see stronger protections that make 
sense. Yes, it is a balance. Stronger protections for data 

Ms. Lujan Grisham. Where do you see the balance? And nobody 
I think on this committee is making any sort of statement that we 
should reduce privacy protections. But when they become an obsta- 
cle — that does not diminish the protection of privacy, we have a 
really big problem here. 

I gave you one illustration. There are many. But what is a mile- 
stone to not diminish the protections that we are all interested in, 
but to get us to real patient records, serious interoperability, not 
just provider to provider because of proprietary, but as you men- 
tioned in an earlier meeting, within our hospital equipment, which 
creates huge patient outcome issues, that is not a privacy issue, 
and gets us to telehealth, all the different kinds of things I know 
that you all are promoting? 

I don’t know if the chairman is going to let me keep going. What 
a good guy. 

Mr. Hurd. Mr. Quinn can answer that question. 

Mr. Quinn. I would say a wonderful milestone is getting to 50 
percent alternate payment models by 2018, as HHS has proposed, 
and that Intel, eating our own dog food or, as my colleague says, 
drinking our own champagne, including in Albuquerque, where we 
have a huge facility 

Ms. Lujan Grisham. We would like that to be bigger. 

Mr. Quinn. Thirty-three-thousand employees are today partici- 
pating in our Connected Care program. The real enabler of this is, 
of course, that there is something called the Sequoia Project that 
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makes interoperability possible in connecting 150 different EHRs, 
but more importantly, that we are directly contracting with the 
providers in that area and we have purchasing power. 

We are doing this in Albuquerque. We are doing it in Portland. 
We are doing it in Arizona. 

Intel is a big purchaser, and we said you are going to participate 
as part of this, and we are going to collect these metrics. 

The same is happening on this national basis, this 50 percent. 
Fifty percent I think is a real tipping point, because you can’t live 
in two different worlds. You can’t live in the fee-for-service world 
and the alternate-payment world. 

The sooner we can get there, the better. We can’t let up on the 
accelerator. 

Ms. Lujan Grisham. Okay, thank you. 

Mr. Hurd. Thank you, Mr. Quinn. 

Raise your hand if you have suggestions on how to harmonize 
privacy laws, and which privacy laws and regulations need to be 
harmonized? 

Mr. Savage, your organizations don’t have opinions? 

Mr. Savage. We do. We don’t look at them as harmonization. We 
look at them as protecting privacy for patients in all the different 
States. 

Mr. Hurd. So I would like all of you all to submit those ideas, 
those white papers, to the committee for the record, so we can re- 
view those and see if that can be an area that we look at. 

I would be remiss if I don’t ask a cybersecurity question. 

Ms. Rich, this is for you, and I am not interested in any par- 
ticular company or something like that. What do you think is the 
biggest threat right now to health information and our citizens’ 
health data? 

Ms. Rich. There are a few. One is failure by companies still to 
take this as seriously as they should. There has been a lot of 
progress in recent years, but we are still seeing not enough atten- 
tion focused on this issue. 

Congressman Lieu also mentioned ransomware, which is some- 
thing that is on the rise and is particularly on the rise when sen- 
sitive information is collected, because of the great interest in pro- 
tecting that information, so the ransomware tactics are more likely 
to succeed. 

We are seeing that more and more in our cases, and we are look- 
ing at this issue ourselves, and maybe doing something publicly on 
that. 

But the number one issue is still the failure to pay enough atten- 
tion to this issue, among many, many companies. 

Mr. Hurd. Mr. DeCrescenzo? 

Mr. DeCrescenzo. Obviously, Ms. Rich has her perspective, 
what I think at the HLC, we are taking this very seriously. And 
we see across providers, payers, pharmacies, everybody who is part 
of HLC, an enormous amount of investment and forward-thinking 
on what to do about the problems that you described, for example, 
at Hollywood. 

I think one of the challenges everyone needs to recognize is that 
we are also trying to constrain costs as much as practicable in the 
U.S. health care system. And all these things come at a cost. And 
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there is not necessarily as much freedom, or maybe should there 
be, to be able to capture reimbursement in order to reflect those 
costs. 

So I think it is a very difficult barrier when you think of the re- 
sources that are applied anywhere from telecommunications to 
banking to other industries around cybersecurity, the fact that we 
have all described the importance of personal health information, 
and recognizing that many of these institutions, including many 
hospitals I’m sure in your districts, are already struggling to deal 
with a number of other aspects of successfully providing patient 
care. 

So I think we certainly see people taking it very seriously. As I’m 
sure you’re aware, many people go into the medical profession be- 
cause they have that commitment to patients, their data, and pri- 
vacy. 

So I think one of the things we need to consider is how well is 
reimbursement reflecting the cost of doing a good job at it. 

Mr. Hurd. Ms. Rich, what has been the biggest fine that FTC 
has issued on a private company for violating our privacy? We don’t 
need to know the situation, just what is the dollar amount? And 
can you describe the situation? 

Ms. Rich. We actually, in the initial instance, don’t have fining 
authority in the data security area in general. We do when it in- 
volves kids’ information or consumer credit data. But in the general 
data security work we do, we do not have the authority to obtain 
any penalties. 

That is, I think, something that we seriously need in order to 
create different incentives here. 

Mr. Hurd. If a private company would have lost the information 
on 23 million records, what would FTC have done? 

Ms. Rich. In the abstract, it is hard to say. Each violation, if we 
had civil penalty authority, just borrowing from the authority that 
we have in other areas, every violation could amount to a $16,000 
penalty. So if you add that up over millions of consumers, it’s po- 
tentially infinite. But, of course, we take the ability to pay, et 
cetera, into account. 

But the fines could be quite high for a company that had very 
serious violations and injured a lot of consumers. 

Mr. Hurd. Thank you. 

Now to close this out, Mr. Blum, you are recognized for 5 min- 
utes. 

Mr. Blum. Thank you. Chairman Hurd, for holding this most im- 
portant hearing. 

And thank you to all the panelists today for your insights. I ap- 
preciate it very much. 

Telehealth, telemedicine, has absolutely intrigued me since I 
have been in office the last 15 months. When we talk about rising 
health care costs in the country, I know many citizens want a sil- 
ver bullet, one answer, one thing that is going to solve the increas- 
ing health care costs. 

I kind of believe, pardon my pun, I believe it has been death by 
1,000 cuts, the increase in health care costs. It has been a lot of 
small things. And I think one piece of the puzzle, the solution to 
keeping health care costs in line, is telehealth or telemedicine, and 



148 


particularly in our veterans’ care system with the psychiatric care, 
PTSD. 

I know in Iowa, it is rural, so we don’t have a lot — in all the out- 
patient clinics for vets, we don’t have a psychologist or psychiatrist 
on staff So telemedicine is a great application there. 

I would like to ask all the panelists, what policy changes do you 
think are necessary so there is 100 percent — 100 percent — tele- 
health participation by providers and by hospitals? I see it as criti- 
cally important to saving the government money and also improv- 
ing the outcomes of our patients. 

So whoever would like to take that, jump on it, please. 

Dr. DeSalvo. Congressman, perhaps I will begin and say that I 
share your enthusiasm for telehealth. As a doctor, I have had the 
opportunity to use that, particularly for access to psychiatric care 
in my home community of New Orleans after Katrina, when we 
had really a lack of services. As a rural State, we have been able 
to leverage that as well. 

So as a care delivery model, very well-received, and can also save 
people money, because they don’t have to take off of work and find 
health care, et cetera, to go to the sites. It is less of a technology 
issue and more of, I think, an opportunity as we move to alter- 
native payment models. 

So as the VA has been able to show and the private sector, and 
certainly through some of the work that the department has done 
with these models in the Center for Medicare and Medicaid Serv- 
ices, we have been working to advance that as an administration, 
in partnership with the private sector. 

I think it is something that we see as a department an oppor- 
tunity in the delivery system reform work that is moving to alter- 
native payment models, such as in the MACRA legislation that is 
required for docs. It is going to give us a lot of opportunity to really 
enable and support new kinds of care models. 

So from our standpoint, we believe that, with the department, we 
really believe that we are moving forward into this world and that 
the MACRA legislation for docs, in particular, is going to be help- 
ful. 

Mr. Blum. You are a medical doctor, correct? 

Dr. DeSalvo. Yes. 

Mr. Blum. I know you cannot speak for the medical community, 
but what is your impression or your opinion of the medical commu- 
nity’s opinion of telemedicine? Is it a good one? Or do they say this 
isn’t that good? 

Dr. DeSalvo. So I can’t speak for the medical community, so I 
will speak for myself and my peers, that there are some real bene- 
fits to it. 

Speaking purely as a doctor, I think one of the challenges is 
there is a lot that you gain from being in the room with a patient, 
you can touch them, you can listen to them in a way you can’t nec- 
essarily through technology. So a mix of kinds of interaction is typi- 
cally what we want. We wouldn’t want it to all to be remote, be- 
cause you also gain something from that touch in that exam room. 

Mr. Blum. Absolutely. 

Others? Yes, sir? 
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Mr. DeCrescenzo. Congressman, one other thing I would men- 
tion is harmonization of standards across the States. 

Obviously, with telemedicine, as you described, it is something 
that brings the ability to provide care across distance. And, of 
course, many of the States are quite large, so it is urban to rural 
and various other ways. It certainly would facilitate the growth of 
telemedicine in a very important fashion. 

But in addition, there is quite a patchwork of regulations and 
standards on a State basis across the country, so the ability to le- 
verage perhaps highly specialized care outside the State is often 
more difficult for somebody looking to put together a national net- 
work or even nationally focused providers like Cleveland Clinic and 
others who have a very large footprint across the country. 

Mr. Blum. And what would the solution to that be? Is there an 
easy one? I like easy solutions. 

Mr. DeCrescenzo. Well, we have 50 States, so I doubt there is 
an easy one. 

But I think there is increasing, I would say, similarity between 
the regulations of different States as they become more familiar 
with this. And perhaps like a lot of the work ONC and others have 
done around harmonization of technology standards, we would 
hope there would also be a similar effort to harmonize the stand- 
ards and regulations around telemedicine. 

Mr. Blum. Yes, ma’am? 

Ms. Rich. The FTC in the competition area, which I don’t person- 
ally work, but we have done a good deal of work on breaking down 
barriers to competition that may hold back certain alternative 
forms of medicine. 

For example, we have commented to States that may have laws 
that favor certain medical techniques over others in a way that 
interferes with competition through State laws. So competition is 
very important in this area. 

Mr. Blum. Do I have time for one more question, Mr. Chairman? 

Mr. Hurd. Thirty-nine seconds. 

Mr. Blum. One of the major barriers preventing a focus on home- 
based health care versus expensive hospitalization — another area I 
am very interested in, is keeping that person in their home as long 
as we possibly can or getting them back to their home as quick as 
we can. Thoughts on that? 

Mr. Savage. I would jump in and say that is a good illustration 
of perhaps an interoperability issue. We want to make sure that 
the patient’s home is connected with the system. 

So you want access. You want the patient to be able to send re- 
mote monitoring information to the doctor’s clinical record. These 
are things that are actually in the process of being developed on 
a national level. 

That kind of two-way communication between the home and the 
doctor’s system also contributes to care planning, so that you actu- 
ally have working together to manage the care and to move from 
care to health. 

Mr. Blum. This could apply to nursing homes as well, correct? 

Mr. Savage. That’s correct. 

Mr. Quinn. I would say that one of the things that really is lack- 
ing today is ensuring that those home-based applications have a 
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market. So today without the reimhursement for many of those 
things, the market hasn’t blossomed the way that it could. Many 
of the applications and the tools aren’t necessarily designed for a 
78-year-old or maybe somebody with disabilities who is at home. 

Ensuring that that, frankly, consumer marketplace with the 
technology that is rigorous enough to be trusted and incorporated 
into the health care system is built and that there is a marketplace 
for it, because there is reimbursement, there is a path for investors 
to say there is something here. 

Mr. Blum. That’s a good point. Thank you very much for your 
input. I appreciate very much. 

With that, I yield the time that I do not have. 

Mr. Hurd. I would like to thank Mr. Lieu and Mr. Cartwright 
for the bipartisan nature in working on this topic. It is important 
for an exchange of information. 

And I appreciate our witnesses taking the time to appear before 
us today and for your patience. 

If there’s no further business, without objection, the subcommit- 
tees stand adjourned. 

[Whereupon, at 4:22 p.m., the subcommittees were adjourned.] 
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Re: Recommendations on Harmonization of Privacy Laws 

Dear Chairmen Hurd and Jordan, and Ranking Members Kelly and Cartwright: 

Thank you very much for the opportunity to testify at the Subcommittees’ joint hearing on 
health information technology (health IT) on March 22, 2016. I am pleased to provide 
additional comments regarding the harmonization of privacy laws. 

Secure and private electronic information exchange can enable safe, more effective and 
more coordinated care; greater consumer engagement in health; and ultimately improved 
patient experiences and health outcomes. However, misunderstanding and confusion 
persist about when health care providers and other entities covered under the Health 
Insurance Portability and Accountability Act (HIPAA) are permitted to share a patient’s 
protected health information — with other providers and with patients themselves. 
Ultimately, this confusion can result In organizational policies and practices more likely to 
restrict appropriate health-related data sharing, rather than enable or promote it. 

To address this multifaceted issue, we offer the following recommendations: 

• Efforts should focus now on harmonizing HIPAA-covered entities’ organizational 
practices with current law and guidance on data sharing, which may alleviate 
confusion without having to harmonize laws. 

o Education initiatives are necessary to inform both patients and providers on 
the correct application of data sharing and privacy laws. 
o This will in turn help to harmonize patient experiences so that they are 
consistent regardless of provider, setting of care, or state of residence, 

• For health IT and patient data not governed by HIPAA (for example, stored in apps 
and other electronic platforms), consumers need transparent, easy-to-follow 
information about how their data are collected and used. 
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The issue: Misinterpretation of HIPAA poses sisnificant barriers to data sharins 
HIPAA governs the collection, use and disclosure of individually identifiable health 
information by covered entities. Specifically, the HIPAA Privacy Rule and Security Rule 
set forth requirements to assure that individuals’ health information is properly protected 
while allowing the flow of health information needed to provide and promote high quality 
health care. 

HIPAA sets baseline rules for how health care entities may collect, use and share patients’ 
health information whether in paper or electronic form. But as the health landscape 
changes rapidly due to the transition from paper-based to electronic health records (EHRs) 
and the increase in consumer digital health tools (including wearables, telehealth, and 
smartphone applications), many providers struggle to understand how' to comply with data 
sharing and other patient privacy requirements in the electronic health ecosystem. This 
confusion is compounded by individual state laws that may provide greater protection, or 
additional restrictions, with regard to sharing of certain categories of patient data such as 
psychotherapy notes and substance abuse information. 

Early feedback from our GetMyHealthData campaign^ has illuminated the numerous 
barriers that individuals face in accessing and using their electronic health data. 
Consumers navigate a complex, confusing, time-consuming and costly process to request 
their medical records and other health information under the traditional HIPAA records 
request process. Sometimes, uncertainty or confusion over HIPAA permitted disclosures of 
health information leads providers to refirain from sharing patient data with patients 
themselves. For example, Adele (last name withheld) shared: 

“Medical providers treat my data as if it were top secret. I understand their concern about 
revealing my data to third parties, but many are reluctant to reveal it to me. How can I 
make informed decisions about my own health if I don't have information?” 

Additionally, many providers do not understand the rights that patients have to copies'of 
their health records and other information in digital formats. Under the HIPAA 
amendments made by the HITECH Act, consumers have a legal right to an electronic copy 
of their health information. The Administration recently clarified that consumers can 
exercise this right with any covered entity as long as the provider can produce the data 
electronically, noting that making digital copies available is a matter of capability rather 
than willingness. Again, numerous GetMyHealthData volunteers have reported being told 
that electronic copies of their health records are not available to patients; as more than one 
volunteer was told, “We don’t do that.” 

There is also persistent confusion and misunderstanding regarding the fees that providers 
are legally allowed to charge patients. For instance, we have collected examples of patients 
being charged per-page fees for electronic copies of their record and being charged 


^ GetMyHealthData is a national campaign, coordinated by the National Partnership for Women & Families, in partnership with 
AHIMA, Amida, Alliance for Nursing Informatics, Code for America, Flip the Oink; the Genetic Alliance, Health Data Consortium, 
NATE, and other individual thought leaders/experts. The campaign helps patients gain access to their health information in 
electronic, computable formats, offers educational resources to patients and providers, and advocates for advancements in policy 
and practice. 
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expensive fees upon receiving their record, with no estimate provided in advance. These 
costs often pose significant barriers for patients in accessing their health information. 

One of our GetMyHealthData volunteers is the mother of a child with a rare genetic 
syndrome. Megan shared her story of overcoming many obstacles - fi-om high fees to 
puzzling policies and procedures - to get copies of her daughter’s medical records from five 
hospitals in the mid-Atlantic area so she could better coordinate her daughter’s care. The 
costs associated with getting records from each hospital differed wildly (see Appendix A). 
This kind of variation, between providers in the same region as weU as across all fifty 
states, creates additional stress and confusion for consumers and patients who are trying to 
access and use their health data to improve their own health, or manage the care of a loved 
one (see Appendix B). 

Therefore, the first task at hand is to harmonize providers’ practices with existing laws for 
securely and appropriately sharing health information between providers and with 
patients. While we recognize that the relationship between diverse federal and state 
privacy laws complicates the process of sharing health information, from a consumer 
perspective, increasing education and consistent application of existing federal laws and 
regulations is the critical first step in facilitating the secure and appropriate sharing of 
data, both between providers and with patients. 

Recommendation: Clarify how exi.stins laws (such as the HIPAA Privacy Rule) avplv to 
access to health in formation and data sharins 

The Department of Health and Human Services’ (HHS) Office of Civil Rights (OCR) 
recently published guidance that provides clarification on components of providing patients 
access to their health information, including how long providers have to respond to 
requests, the format in which providers must provide copies, and what reasonable fees they 
are allowed to charge. 

However, federal guidance and enforcement alone are not sufficient. Complementary 
education efforts are needed to help providers proactively and successfully bring their 
practices into compliance with privacy laws. 

Recommendation: Provide transparency about data sharins practices for digital health tools 
not covered under HIPAA 

The rapid transition to digital health information sharing has also spurred innovation of 
new devices, applications and technologies. While other regulations may apply, HIPAA’s 
privacy and security protections do not apply to many commercial apps and personal health 
i-ecords (PHRs) unless provided by HIPAA-covered entities such as providers, payers or 
their business associates. 

As consumers increasingly use health apps and devices not covered under HIPAA, it is 
critical that they understand the data use and sharing practices of these apps to make 
informed choices on where to store and access their data. A standardized, consumer- 
friendly disclosure of data sharing practices and privacy policies gives patients this kind of 
transparent view into these tools. This useful way of explaining uses of data is important 
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because almost 90 percent of consumers report that it is important to them to know how 
their information is collected and used.^ 

The federal government continues to take steps to make it easier for the private sector to 
provide patients this kind of transparency. Notably, the Office of the National Coordinator 
for Health Information Technology (ONC) creates and promotes a Model Privacy Notice - a 
template that technology developers can voluntarily use to explain the data sharing 
practices of their personal health record product or application in a simple, usable way. The 
second iteration of this Model Privacy Notice is under development to reflect the diversity of 
technology and data that individuals can now use to manage their health and wellness, as 
well as new business models. 

While the Model Privacy Notice is a great tool to disclose data sharing and privacy practices 
to consumers, many technology developers do not know that it is available to them. We 
encourage the federal government to work with the private sector to disseminate the tool 
and educate developers about why its use is important for consumers and essential to 
promote patient trust overall. 

Therefore, we suggest that robust education and implementation efforts be the first step 
towards harmonizing provider practices with existing law and ensuring consistency of 
patient experience accessing and using their data, in order to equip patients and providers 
with the information and tools they need to appropriately share and use health data. 

Thank you to the Committee for its interest in advancing health information technology 
and for the continued opportunity to share the consumer perspective on privacy and data 
sharing. If you have any questions about our recommendations, please contact Mark 
Savage, Director of Health IT Policy and Programs, at msavage@nationalpartnership.org or 
(202) 986-2600. 

Sincerely, 



Mark Savage 

Director of Health IT Policy and Programs 

Attachments: 

Appendix A 
Appendix B 


" National Partnership for Women & Families. Engaging Patients and Families: How Consumers Value and Use Health IT (Dec. 
2014), available at http://www.nationalpartnership.ora/research-Hbrarv/health-care/mT/enQaQinQ-patients-anci-families.pdf . 
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Appendix A 


Kospitsi and Department 
Name 


Fees 


Addidonal f^rtalis I 

A 


$049 per page for pp. 1-10 if patient is wB!lf»g 

• 

Medical Records Release form available online 

Medical Records arvd Health 


to receive records by emai 

• 

Records could be emailed or mailed 

Information Management 


S 0 J 6 per page for pp. 11+ if patient wante 

• 

No electronic records or CDs available 

Department 


mailed copies 





Mo fee if doctor requests records 



B 


$1.45 per page 

• 

Authorizatiof^ can be faxed jf doctor is 

Care Management Department 


Mo fee if doctor request records or if records 


authorizing 



go to another facility 

* 

If family is making request, mail is used 




• 

Release form must be mailed 

C 

Electronic; 

• 

Authorization to Reiesse/Disclose Protected 

Medical Records Request 


No charge if releaswi to My(;:hart 


Health Information forms available online, but a 

Department 


$0.13 oer paqe for CD or diumbd!^ 


hard copy must be signed and sent to the office 



$10.00 per CD for radiology images 

• 

If picked up, CD takes 5-7 business days to 



No charge for cor^tinuing care 


prepare 


Paper: 

• 

If mailed, CD arrives in 15 business days 



$0.50 per page for pp. 1-50 





$0.25 per page for pp. 51+ 





$1.00 per page for Microfilm 





No charge for contifiuinq care 



D 


$0.50 per page for pp. 1-50 

• 

Had to go in person to access records 

Health Information 


$0.25 per page for pp. 51+ 



Mar^agement Department 


No fee if doctor requests paper records 





Providers pay $0.50 per page if records are 





emailed 



1 


$0.39 per page 

• 

Authorization for Release of Medical 

Health information 


No fee if doctor requests records 


Information form available online 

Management Department 



• 

Doctor's authorization required 




• 

Records will arrive in 21 business days to 





patient/caregiver 
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Appendix B 

Medical Records Copying Charges 

-'•'ribl -vr t <= 'r h , --r P'S"!-- (- ' »!oi s sate that eraarsi the amau?U of mens'.' doctore. -ho^lals are other health care p^rovifle's car) ctiarpe for 

cDiCiSs ot medical records provided to the patient or the padenf s for Hse in personal injury or wrongful death civil cases. Note that t cere triac other 

'^tf- hi r.paiai I rsb' c i -t nclaims Soci^ Secusitj' dis^Wy matters, ^c. 

> - Ji nste t| i« par,*- I c| a.|pan ‘ n^- tttjB' vr lo’flsionstostatitfes^resdyp^ed'. as&jch there is no regular time pom* at •*hich «e do this We cennot end do not 
tepresent that all statutes are up-to-date. One t -/pe of rewSion which is espesi^l? RWd fw us to keep track of has to do with cost changes alio-ve-j annuaiA by a statute and 

OHyi-'l I'- at nr ale 

Please aswavs view the actual statute when there Is a link a--'a!aWe ard afft^vs dwek any “UPDATE" link which you may see for a pahicula; slate because these items 
V sti'crmti-t a* n , e cu-’^ t‘ than the summar,- ted 'Mtich sj^sars on this wefc page 

i 1 ’ 'r= m 3 idi’irr ute .b r r-rj^y q,, pj^ pig^e 3 5}5g_,^gj-„,} 5(3{^;.g jq [_3nib, 

L f in a r ticnr r. li rr o up''3t£' rnqardii^.g the slafoles listed on !his s.'seb wge stools be ajtvnitted to Torn Lamb 

r )>•„ i-j -5 I p , 1 fi A I >iir}taNlilv Ac! iKPAA) a cev^s etotv csk <«T iv chage 'reasonablB' cost-based fees for prosiclinc the msdical records to 

rJt-i t'' CFP I*'- :_i A o-aef, ‘cC' that are n« cost-ba^ even if pernirtled by a aae statute, may be ccotrar',- tc the HIPAA regulation and the-etare 

c e c eo i;. ini 'ey •. r^-c liul r 

Li •> 1 s ni- ny ecc 3 rei .lo"' mci e h's’^tals ato terfain athenrwtiMtc-nai health care pcvidWE to mantam medicai records for specified pe-iods. but those lav'.e 
■si t, rot appi die t, 1 * ph rj ,-'n« jrpbisician groups See this ^ Safe fetotdmietoai reauiremtstts list foiito or- the wv/w.Healthilgo'-- webSite list 


Pc e ric • r tnnt tt-f mater ois ' *1 is ?‘Hc rag^ are f« gertcr^ informatiwr purposes only, cmd is not intended as legal advice 


• Read mors about the taw Offices of Thomas J. Larr^. P-A. » 

■ Go to this Request Form it» order to receive a Firm &ocbure » 
« Here you can see a list of our many Case Evaluation forms » 


All AKI AZl ARi CAi COi CT! DEI DC| FL! GA| HIj ID! ILI INMAJ KSi KY( LAf ME! MOi MAI M!i MNi MSi MOs MTi NE- NVl 
NH I H..M t^M 1 NY i NC I KD i OH I OK i OR ( PA I Rl I SC i SD I 1>j i TX i UT f VT I VA 5 WA S WV ! VVI f WY ! 


Alabama 

Section i Alabamc CosSe Rgproduefior, 

The reasofvabie costs of reproducing copies of wntler c ly'pec documents, or r^Kvfs shall not b« mc?e dyjn 


• Ons Uollsr fS1 ) for each pans of the first 2.5 pages 

• Not more than 50 cents (S.rGi for each page in excess of 25 pages 

• A search fee of fli-e dollars (S5j 

• If the medical records ar* mailed to (he persot making the request teaswiabla costs shall inciade foe actual costs of mailing the medical records 

• A person nay charge m addition to the afaa-j« fees the actual cost of reprooiKirtg X-ra-ys ano other special medical records 


Alaska 


Ariionj 

ATsS. U-2295 

Except as otherwise provided by law, a health cate pro-Wcler or contractor ma> charge a persen' -wtro requests copies of medical records a reasonable fee for the prixfutlion of 
the records E>se|:»t as necessaty for corttinutt.y of care a heatth care pro--icter or contmetot may regtiire the payment of any fees in advartce. 


Arkansas 

Arkansas Code Annotated [A C.A.] Sec. tS-tP-lOl; 
Medka! Slinks and Doctors' Offices 


• May charge no mere than EC-. ^ for (he first twenty-fore (25) pages 

• No more than $0.25 per page tfieieaftei for easting !Beofds 

• A labor charge not exceeding $i5.00 m.sy be added or a reascn^'le rstrie.'ai fee for off-srte stored records 

• Actual cost of any required postage may also be charged 

Hoapitc^s and AmPuiancs Providers 


• May charge a ’’reasonable smounl.' fo’ recctrcls retr-eval cfod re-stwage in addition to the phcacooj^' charges 


California 

California Evidence Code Section ISCiO-tc-oT 

• Not more than S. 10 per page fo' 6 5xi4 metos i»iess 

• 5.20 per page for micrcsfiim c^es 

» actual costs'forthe repioduclion of oversize documents or foe reproclisticncvf documents rea-Bting special processing which ar* macse in response fo a subpoena 

• reasonable clencai costs irfcurred ir iocatir.g ar-d makirtg tto records r.-aiJsbte to be biBeo at the maximum .’ate c»‘ twenty Your dollars [%2i\ per hour psr person, 
computed on the bas-sot six collars t$t>) per quarter hour or fraction irrereot 

• aci.usf postage charges 

Eo-ience Code Section 1155 


. “ir "C” ter pvje ■'or cfo'-jmt'ts £ 6x'.4 inches or less 

• ‘7'.ver‘iv ce.'sts (4 .i;o' per paoe tor oocumsnt cewes fosn microfilm 

■ Ai tii III- -tc 'Cl c “fare .lo o' sf»cial processkig 

• ReasanaWscier.cat costs to relne-re records: 54 DG per qaefoer hour or i*5S 

UPDATE: California Health & Safety Code Section 123100 
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Cdorsco 

C.R. S. 251 -802. Parent records in custody o! iiidivtdud heal* care pro^d»« 

I- •> .?< ' ICfirq tea'-c- I'- (vsltisl a health care tseiSity ma-y charge a tfiird party The iees may not exceed the fc^ioft-ing 

■ F ^,33?' Ml' •> ih *C\ 8^ ;«jtsper fsCB 

■ Lo ‘ ^ ii 51 cj H » “-tC ='(Hi p“r rHjgei^ rscofifeexcepithore^red on niicreWmjof s’.SOperpage i.'ecords itfflsc oi' niictofiirn) 

■ I eii’i TiT m'j'3 ic •'fc I re - 1=3 S'C.^vfee 

■ A ■ < ^ Mt ' ' fc-*- i s-T I *- 1( c t if jf pii i»We 


ro ihen ccteM 3 ' *r* ti<3ttinrf“ '<■ i. It Dfizearepf6s«?l3live. wpureusittea Afitten airthKizatiat a fKO liter £> S'pl c i''i:d II - ' ~ 

5 ' tr t e re'S'r !T'"tn_ s I I equ* cco r'*he p.^iert's hesfth record, inciistirra btd not limttec to faiBs. x-ra,s rfid -/ -firs '••"■It-! 

'■i> an."'- ta'e-c ^ '•<nmi a’-i '• * nal cotta-t lensfittir^s^-^en viittantt® p^eding ttroe moiths or ssrh la-ct-f peroi "t t rtic .s -- c I’f v,<r ji 1 1 i no 

! 1,-- t 1 r-n - TV '« prs. r tic s grK. otner technical infcnnatism used in aswsang the patient s hea '1 cot ati.t N"- ore ia®f shii 33 e i a 3t 


Si>+ o cAr-'- jrfT tags Tiusirg sn 'ssearcr fees. Itan^irtg tees k" related costs and the cest f-rst class postage applicable 

C^.si* Si.,'r pto a.’i i a. ,r'3-’)e c oahAr; the ar^tciurt rtsce^wy tocc^wthesoa maten^s fer fwnishfftg a'cop-v c« 33 .r-ra.' iWO'.'icfed no s.ich chai'ge shall be n-ade 
Jor tumisliioq .1 nealfh record nr pari the^eor to s pai«ad. atfemtey sattohjsd representative if the record or psrt thereof is neces.'wi'v for :!-,e p.k;roose-of Siippoitmg 
a cioiin or appas: urrdar aov orcvision of the Serial Sacuirty Act 3HG t'ls recast is accanpanred by documertcaion of the claim or appeal 
.-s provicer shah fttmsh a health record reaueyed piira,anl’to this sectKsn -Aithin INtty days of the request 


Seclior; l9s-4'jC‘b 

Uporv the fritter) request o‘ a psfiert or tire pat'ents attorney or suthonzed .representatr.'S- wpipmunt to a wntten authorization, ars institution iicK'.sed pursuarit to th.is chapter 
shall tunc.sh to the person making such request a cc¥i> of the patis^'s health recerd. indiKRt^ bjt not limiteQ to copies of b.iis iat^-oraton reports presc'ip'.ions ana other 
fechiiica! iniormaSiori used in assesyng ttse patiecrt's trealth tandSiof! 


• No inatitiilion siral! charge oiore thnir si5<ty-rV-s .'rents per p^s. irxtudir^ arr.- rs^arch fees clehcai fees hanSing fees err fel.3ted co.5ls and the cost of first da.ss 
postage. 


Delsvvare 


Arrevi’ rale effective November 11 200D, limits the*ee? a practice-may charge D^a»'3tsp3Si6t«s for copies a the patient's iredicgi records that it provides either flmilyto 
tire patient or to snotlrer physician These fee limrts apply to both etectromc arrepe^ci^es 

■ SI2 OQ per page for pages 1-10 

• Si.OOper pageforpsges n-20 

• SQ.^Operpageforpages^l-fjO 

» iO.SO per page for pagas 61 and .pfcovo 


tn adtiition (.0 thie fees above, practices mas- charge the folle-vins. 

• Whrmttre r»f.sfcl.s are mailed pra«ice,s nrey charge the actual cos?, of prrstage or shippirtg. 

■ vShen the type of record repuested cannot be photocopied lytch as radiology Sims or fetal n^orrtortng strips), practices rtwy charge the cost of reproducing the records. 
Practices may require paymenl of all costs in ad-rence of reieasrts the records except hjr records related to an aw5licaticn fo'' a disability benefits program 


District of Coiumtila 


Flonda 

Florida Sta'Afi'es ?®.K) 2 o 
Regarding records from ho^itais: 


■ Exclu.?]'-* charge for copies may include .sales tax srcl actu.^ postage 

• Non-papsr records not to exce^ E2 QC? per page 

• Pa)>er records not to exceed S1 DO pet page 

• An .addilional &1 00 may be charged ftsr each year of reewds recrure^K} 


Florida Si.'jtuies 3.W.rf01. Itemized Patient Bill 

• The fscihly mffv not charge the patient for matong sutn verificatiw. recorts avaitefcte: h<rAS\-^. thefKHiwnta-f ihameilsusualfesforproyicttnfl copies of records 
s|;«cifiedms. 39-:.3('25 r- » . v k u 


Rule WBS-lO.OOS. Floiida Admir;:st!afi-.re Cooe 


Regarding records frem physcians 


• No mcj« than t1 00 per page for the first 2? pages of written material 
■ $.2S for' each sciditional page 

• Actual nos4 of repfcsiucing nonAntten records aich as x-ra,s 

• -Recagnizing that patient access to medical records is tmjxsrtarrt stndnesesssr-- to assure c^iuottv of p.^tient cars, the Board of Medicine urges pln-sicisnsto provide 
itieir ireiients a copy <>'• iheir medical leco'tis -jpoi-- lequest. without cast, espeoiaftyAhai itrepatiem isecofiornuaiiy disao'-antaged." 
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■ - c»- np ‘ ,£ -n, te Ih: f-" or «^3rth. relrie-^. arKi irtHsr (irsct adTiirtaratfvs cods 

■ " r rjt n. al re ti' uIk be chargednol toeaesl$9.?8forsach rK;»jc6ftifia<f 

• ~t 1-1 i. f, u,- rfc- i tn itn__ he !«jjeagd r««03 mav' ateo be charged 

, r . r l~ c I- pa^^r ofm shaH not ejxeed 

• ■'(.“r '’p- r t ►- I <1 . 1 . of l'-eps<i«!»'sfecwds*1vcha-^coped 

• * fW f-'r p ’ hr' -gh IHO 

• 1-1 h p t K *-J I" ex p^4 'iJC fie^es 

• pp I i j 3 ^i r ase for inflabon. 

• F-' -ie-j V. p" Ti ^ 1 p e r t ir pa^^r om !r>cli>dii^ but rsoj iimiJed !o rafflok^'films. ?he pTOwtwar^l be er.titted to reco-.’sr the fd: reasonable ccs£ of juch 


UPDATE; Juiv 2014 



• Fe.. '•'■r <t: >• "■t- rc.^-" b 3 hejlih care pro-.idsr in making cofsesc? msascai records shaS be i»rr» by the reqiig^iog pefsor>. 



'f- I t. L*- '“imtstjr^ec fcj The psc?on reques^irig such lecads at (he time such cr^xwg, for^i reas-'X'abie eiepfir-ses indtsding (he ccssts of inciej^erderit cop;.' 

sef 'ice CDfipanica incurrea by the practitioner m -lorneclioavflth sucti cc^^rrg noi to exessd. 


• a S S 1 handling charge ft" proces&tr-g the request tor topres 

■ iC' S5 cer-is per ps^e for ths first thro'.rgb 2cth pages 
» $&.5:? cents per psae fw the 25th through- 5l)!h pages 

■ 5>D 31 cents f^r page for :dl pages ir^ excess o? oG 

• tl'.e charge shaij not exceed Sl'5:‘ per psge for ary- copies rrxgds from microfiche or micrtsS^ 

• arts a-:tual shtppu'g costs 

These rates shall be aulomaticali-i adjusted as ^ fonh ir Sectia^ S-2^. The |^<sician w other pTSttiUc-wr may, fw/.e.-er charge for the reasonable cost of at! duplication of 
recced matenai or irtfomaiior. th.:U cannot rcAiftnsty be copied or diipliccaed on s standard cwnmercic^ frftsfstop,- rnach-rve such as *• ray filcns or poiures. 


UPDATE: 2014 Annual Adjustment 


Ificliana 


760 IAC1-71-3 

• First 10 pages - SI 00 per page: no per page charge isaiiOA-ed for the first 10 pages if a labor fee is charged 

• Pages 1 1 tiiroiigh tiC - SO cO per page 
» Paoes El artd hrahsr • SO 26 oer page 
■ Labor fee -520.00 

• Actual costs ot matiirtg 


iOA'a 

4S CFK jCorte of Federal Reniitatiniis) 1M.524jc}i4} 

If the individual requests a copy of the PHi (protected health infonnation] or agrees to a surnmary or enplar-ation of such information, the covered errtit)' may impose a 
reasonabie. cost-based fee. pro-.-iciect that the fee includes only- the cost srl. 

• Ciopying. including the cost supplies for arxi labor of copyirtg. the PH! requested by (he irsdividual. 

■ Postage. *l>«n the indi ,i(JkJHsl has requested the cc^ or (he summary or exc^anatiCMU'iemsiifed- ar» 

• Prepeving an expisnatiori or sunuruity erf Has PHi . if agreed to by ^ve iradi^iduaJ as lequiiod tjv' t>aa3'3fftt ?c>;2)jii) of this uertion. 

UPDATE; Chafges associated with litigation and Worker's Compensation, July 2006 


Kaiisas 

K..5,.A. 6S4S7tfbj vvhich required itw Secretary of Labo' to ars^ualhy adjust the rrisjcmutr- fees (bat ma-y be charged for nw-e-crlrers compensation medical records crying, 
nos repealed bv the 2011 Kansas Legisistuie. Vv'ithoui arvy state guioelmes. federo! Ioa go-r^,s the estaUish-ment of charges. 

See ",4l!ij>vafcis tiiaiges for copying lecorus" (from the Kansas Mecfccai Soosty) 


KemucK- 
KPS 422 317 


Upon a patient's writSisn reoucst a hospital iicsnsed under KRS Chaore' 2iol3 or a health tore proisdef stsaii pro-ide. A-tiiout eberge to the patient, a copy of ti>e patient's 
niodfcai recoro. A copying fee. nos so exceed one dollar (£1; per page, merv be charged fa-y fte hestfth care provider for fumis^^rtg a second cep-r of the patiertl's medical record 
upon requssl sithrw bj ths pniieni or ths paitanl's attomay or the patienfs aulharised rep^seraac.-e- 


Louisiana 

icuv,rjRe .MS-,tl‘le« ‘C 

"or records, a ressonahre charge not to exceed 


• S i iX* per paae for first 2C pages 

■ f-0.5C- per (.xjoe fut 03^,5 26-cGD 

• '=r ere<ri«r 

■ Plus actual costsoe 

r-'' >3 n V coim eiectrcrac ana rmaqino mc-dia 

• Pea r ? Me rac-cxjuction -costs 

. p r h r i|^ ' -ra- ’c'hoiptaif- StBCOfor oih»hsaitheai«f«ovidets 
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• irrc ore lourna :)■ 3 far spying ararfnsasTg-rHa ©Keeais^SGc^ls for each page » the metfica; record fn addition to the f&c charged uoasr 

ih'rrrjnt-t“ i ” ’hic pa a i 3"l a nsspilai or s heallhcare provide ma/cha.^. 

• ft preparatiort ree not fs exceed &15 ?or nieaical racort retn&v® and p?^5»3iK>n 
. Hr sr-i c rtj -ly p''et^gc a-d hanaiing of the mewc;^ reeofd 

■ “i '’3' rii"iiill. ='t5h‘iJ =‘r I"" !r'-4 states that these fees ma? be adju^KS anriualli,'?ori!rf]3<iots in stccfdafKe >vTth the Consoirte!- Price ioefex 

UPDATE: 2012 Annus! Adjustment 


• X'vt M -c. .11 i ir tr c’ J.25-patje or .1 -es for cSehoai Aortt inexce® e^i^O-C^ltour isprBsumjSftefv ureasoiaUe. 

> '(rn-" 'c 'i.p'V' c.* x-n <= gad similar d&cjimerts r»t repRsiuciWe bj-adinsrv be at ikrenices actual cost plus rejsonahie derica! fees not in 


fclEOlCAL RECORO ^ OPYiKC TEE: 2013 UPDATE 


f' ‘1 . ftc'tc "C O’ ''csp’‘ats c- ri— :« atsio^v-; irs-pe.:tion; ccpi«: fees 


Rc-conds Accesi! Act 4? or 2C!Ci 335 20*-;^ Seebon S' Fee' 

• inrtia! reeof S20 33 per reoucst ter a co!?\' of the reewd 

• Paper copses 

• One cfpiiar per page for the first 20 pajes 

« Fifty cents (cer page for pnyes 21 ttriw.-yh cO' 

• T'n^ntv cents for papss o' and c •«! 

x For medions'clrier ttian paper, the actual to^ -of copying 
■ Poftsoe Of ehipsing costs 

• Actuaf ccfsts inc jired for records older than seven vears 
UPDATE; 2014 


Minnesota 

Minnesota Statute 1.44..335. Sobdiviarj;! o 

When a provider w its representali-'e makes copies of palie.nl records upcs^ a patierSs request urtder this sscfioa theprc-tst^’orils rspreserttstive may charge the patient or 
iiie patient's rspresaitative rto mor^ilhan. 


• 7i cants per fsage plus $1C for time spent retris’Ang and copying the records, ur^ess other la* or a nia or contract provide for a ioiAsr maxinium ctarge 

• Tills i(friilati«i d'aes cioi apply to *-rays 

• Til® provider mav charoe a; patient no mo« titan the actual cost of reproducing x-rsjs 

• Plus no more than SiO’fof the time spent reffievino and cc^ying the x-rovs 

• The respective maximum charges trf ewtsper mkI $10 tor time pro-ioedinttas subdf-iaoc are in effect for calendar year 1Si?2 artd may adjust'ScI anniially 
each ciiienciar year as pro>-i0e<T in this .subdi-hsion 

UPDATE: 2014 Annua! Adjustment 


Mississippi 

Siectior 11-1-52. Mississippi Code of 1&72 

■ Maximum cooing charge is SJICr. 00 for up to 20 pages 

■ $1 00 per page for fire next 30 pages 

■ S.50 per page for ail pogas therssffer 

• 10 percent of the total cT-arge ms> tse added for postage ano handhng 

• $15. no may he rftr,ov«-ed by the medical pro, icier or hospital » r.u.rsing hom.e tor retriswfyi medics! records ett afr.hivfift at .a lr>c.3titMi off the firsmi.S8S where the facility is 
locates 

■ Actual cost of t8pri>ducitig x-rays or ottier special records 


Missouri 

Missouri Rovisrad Statutes §•121.22.? 

» .A hainiling teo of $17 06 

• Plus a fee $ 40 per page for copies of ckxumtmts made on a standard photocc^- macNne 

• Pro.i^smsy ct'arge fc the reasorsb!® cost of all aiipiicstionsc^me^s^ lecard matehai or information whxch cannw rctitiosiy be copied or dt^hcated on a siandari 
copy machine. 

Pt'ovides that effseti'/e Februar’.- 1sl of each 'year the handling fee taxi per oags fee wtil be itver^Ksd cw dec.’eased based on i!ie annual csercsnfage change in Sine u-nadjusted. 
U.l City a.'erags. annual average inflation rate of Uiemed;cal caie COTponsii? of »ie Consurner Price rrak-x f« sli urban tofssurners iDPI-U). 


UPDATE: 2015Annua( Adjustment 


Monta^-iii 

<ifv?n V -V'r. 5:0-1'K-4i: 

• .A FRasnnsDle rcr pro.iriing hssitit cs'e rnforTria'ion may rs)? exceed £S f&r each page for a papex copy or ph-iotoc-opy 

• A reasonable fee may itKkide an odministratrve fee that may not exceed $16 for seorcNttg zrvi hatwlling recorded health cars infomistion 
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. Ar^asot 
■ A lessor 


"able fee for fwo'-iidinq heaKh care sriiormaJ-en may rxS ewesdSDcerisfor'eachfSjffieftK a pap»-cc^- w ohoSceopv 

'.able fee max- inclutle an admiRrsttsl^-s fee 8i<8 may nc4 sjkssc >'£ f« s^cheig hanrKRg recorded health la’s iittorniahon 


a '•*' ri “ I r r • I f'’C'' f '.*rf nc^'afs as a har^Sing fee 
n * dv cents p-r cajb A' a -op tn 'es. 

a^ '■I arc" ’•"■rt'-e e., -ra-le cost of at! ds^iicaacsRs of metScal f6csads'*fach carmrt Ka^insly be copiet: a rSuploted on a standard photocopy, machine 
lav charcc an amount necessary to tty-^ the co3 i*cif and m^srials for fi^ni^tng a copy c? m X-fa-,- or s milar spscia! n-vedical record !f the p’o^ber 
foe alcilitv to repr.arruct X-r3v& or i>‘hw recofds req"j^ed, the psfscfi msddi^ the reouesf m%' arrange at Ids or her expense for the te.otxsduclion of ssa;t 

LB ^ 7 . A 4. Effective astc- Aijausr 28, 


1 •/; av-aen 6C c»nis per page fKphfatKopi^arei a reasssabSe cost for copies Of x-fav photo-graphs and cthsr health c-are recor. 
it^sna! service frse of afR- kind ma'.’ be charged forfsHnishing a cc^/ 


'C uoa' ci'c 31— ? res rr* ’'sfer 4'’^- r;ies)ca Rscwds 

rno rharge 'or tne c.-^ving of a pattGot & medical recc^-ds shai' no? OKes-d S15fcrthe first X=p^s or 5.50 per page whichever is greater 
Copies O' Time: rscoras such as raoiograms x-ravs, one sonograms bs esjaad at a rBasonabis cost. 


Nev\ .lerse-,- 

New- .fersftv Afiininstrvative 
Ci£5E!l3ll 


• Sl.trDp^rsage for first 10:>p3oe-s 

■ S.2? per page thereafter to s ma,»irr!i.;m chares cf SSOGCSfo-fheesSirasrecwd 


2d0‘', Uptiafe 

20C'£ ftesdeptiort from NJ Crept, of Health and S«tior Ser.-tces 
Ne-iv larsev Aaministrativa Code §1C:35-S.S{c^-1) 

.CS!.yK». 

• SI M p&rpagc or $10C' OCforlKo AhKrfe record, 'i-hiche-.^ is 

UPDATE: 2012 Copyirtg Charges 


» S30.00 for the first 15 psges 
• S.2E per page thereafter 

. Thfi ac.tisal eoGt of reprorfijction ior eiectrenic records a.id recrrfl fwmsts other than popef. such a 

UPDATE; 2009 Adjustment 


Ns* Yorx 

Sections 17 Ci'd 15 of Public Henilh Ls* 'PHL't LyA-seif I9S1. Chapier 1&5. oeettofss 4S »rd 

The cost car be w more Shan Sevsniy-Five cents ($.75) per page tor p;^ copies and a reasc-riaWs charge to« oa^mcatic images, plus postage. 


North Carolina 

North Carolina General Statutes §5*5-411 

IncluHve of searching, handling, copyir^. anc;: mailing coas: 


• S. 75 for first 2;" pages 

• $.50fcrp3ges2€-i00 

• $.25 for pages over tOD 

■ Minlmitm fee of $i0.0Sp6mv.«ed 


North Dakota 

ND Cent Code P.ection 25-'2-U 

Uportihe repuey fw medical rec-ottls Arth the signed authorization -s' the pcfli«H. thig f»afrtt care proyidsr shall pro-.'idc medical recryds at s charge of rta more than: 


• $2C' for the first 25 paces 

• $.75 porpaye artsr 2o 

• This charge includes s-oy administrahOTt fee, r«hsv3! fee and postage expense 


10 



162 



Except as providsp in divisions (C) ana lE; of bSis ssctioTf. 3 hesitti cai® as.ider or medc^ records company th^ fseev-es a request fcK a ccpv of a patient's niedtcai recora 
fro;Ti titf paltsr .1 or patient’s i^rsonat representative may chatje rtof- more ihgri the aiiounts set fffitb m this’sKtiw;. Iota! costs copies anc aii services relsiea fc- those 
copies shall not ejxsed the stsm of the foliowioig 


» i2 EG per page tor the first tert pages 
« 1. 50 per page for pages ale.er! through fifty 
« S.2D per page for pages fifty'-or>e sixi higher 

• With respect tooSata recover) other than on paper. $1. ?0 per page 

• ; he actucjf cost any related postage incurred tri? the heahhiare proetderor medical ^anfe cKTipar^y 


UPDATE: 2014 Adjustment 


Oklahoma 

'!> Okis Star Sec 15 

•Any person who is of has bco-n a palitr.t a doctor booist^, cr ether medkal ir^stutkat ^4^! be sattitted, liport rGaupsl Ep obtsn access to the infomistion ec-ntained in tlw 
patient's menicai racorps inciuding jir.,. x-ray oi' other ph^cwiap* or image. 


• cost oteacn copv-. r>ot inciuamg any x-ra-r « oths.- cbotosra^ orims^. f®t esx^d Ora Dclsir (Sl.tXh for the first page and rifh.' cents fS,5C) for each 

trng.- 

• 'U prcauvs'he tseext. m at 3 coa r>st ie exceed !w«ve tents ISO. 12) s^d^itsJ page 

• "I I- . ''It ea-n x-'a, n cthe'i Dhotogrp^ c*' imac^ shi^l .rtci essceee Five Deitars rSf.K)) w th« actual coa a' reproduction, y.-nicliever js ies.s, 

• The wvsician hospital, or other medical prcfesaar.ots atsC irt^ituticas may ch^gs a pSiertt te the- actual cost of maiiirg the patia'tt's re-quested rr^edieal records but 
ina.v not charge a ‘ee ca searching, retrieving, re^vie^ing pepanrtg nnedica) records the p^'fson. 

UPDATE: Revised 11/2)13 


Oiegon 

ORS *S2 £2'1 Hsa'th care provider end state heahh plan charges 

.A Itsaltl'r '.are provider or stats health pia-; (hat receives an awhoiiiatiwi to disclose health ir^joriatiKt may chwge 


• No more than $30 for copying 1D « fe-Mi! pages ex' writter; rnatwia avt ho more tharr % c-C per page fc^ priges 11 thrpugif sG and no more tlfah S 2? for each adciSfiorial 
page 

• ^iSorius ctiarge of $5 if request for racords 15 isocesced one .recorts ate mailed 1 r' srS class mail Ss the neqoealar v-ttnin seven business ctTvs ofier th* date of the 
request. 

• Postage costs 10 mail copies of protected tiealth infoimation or arv expianaficr or a^TOmarv of protected health in/ormati'in if rerjueste'J by an individual or a persenai 
iepresfitttaii'.«ft pf the mci’.idu'al 

» Actual costs tjf creparirig an expiration or summacv of protected hesWt isfwrtraiiw. K reqi^tedyy an ird-ictua) o' a pa-senai representative of the individual 


Pennsylvania 

Act 26 selAlhe maxiniuir fees-thsl can be charged for medical tectrds. These fee? ate opoated veartv through fire Iiepartment erf Health. With a fe-r« exceptions the 
maximum fees for a record risquest from a patient cfr attorrve-y for 2iXS7 are as 


• searching and. refhevma the record - $1S 3C 
» pages 1 through 2Q - $1.33 per page 

» pages 21 thrnuqh 60 ■ £ ^rfk p(4f tagpi 

• pagesSI and .after - S.33 per page 
« actual mailing or delivery f'ees 

UPDATE: 2016 Adjusmiom 


Rh.Kls islarttt 

Rule? snd: R-^ulaticins [fni' Mecscsl RecrwTfsiJ 
(see .?ecficiit 11.2., at p^ss 11-12) 

• Not mare thair ^ 25 per page for the first 100 pages 
■ After lOOpages rwt mors than SG.1D per ps»ge 

• Maximum fee ef $16. 00 for retheva! regardless lime s>erH 

• Special handling fee erf art additional S'JO. 00 if records must be delivwsd vwthio 45 hours of r?d(.test 

• Copying of x-rays or olher documents rot reproducible by photocopy at ph-yaitian'e octual cost plus clerical fees rot to exceed 51.5.00 


South Cai olina 

SC ST SEC for Doctors 

A physcian Of ether owrrer of medical records may cbsrge a fee for the ssareh andt&iplic^Kjrt a matScai record but the miry nd excesd: 


• Siay-fi-ve cerrts per page fc>r the first thirty pages 

• Fiftv cents per page lor jrfl other fsages 

• A ciericBl fee lor seaicNirg and bandling f><« to gw.'ssd fr'teen oblars per reauest 

• Pius actisai postage and applicable sales tax 

• . The physician mav charge no more titan the actual cost of repraascticn of at x-ray 
SC ST SEC 4jb7-32£ for Hospitals 

• $.65 per cage for the firs 3D f=agss 

• S.50 per page for all ether pages 
■ Cisnea! fee no! ic e«:eso‘ S IS &3 

• Plus actuji pcslage 

2014 Update for both Dos^ors and Hospitals Statutes 
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auest may rsquifs befsie d^'.’ery ihst Si^ patien; psy the sv 


h f’jr^ Ajta'CJi^sriMKScal Rec£S3s-53-2-1C-2. 

t.* = 'tip^i’sabon cases, such trasonabie coSs ^sll not exceed tienty ddlacs for n 

6-,hf^-ja c^ecS 3flsf Jh-e Sral fwty (4D) paces 


5fds forty i40) pages o: 


s's. Of their authai^d r^fcsentaives for bosi^a! s^ere's. 

atMechars-e” for c^yirtg. The la-* irt3f|»«6 “'easor-aye" riorto exceed a StSfetneyai fee f: 


5 iJages &f the rgcwd 


f. rpF n -C fRP-^ CN H -^THCAR£ifiPORMA11C:ffEFFECm'EOCTC«ER?Oi:!i:hnp«,v*v;6s-;s?t2fetxe;AVw>A<eaT,>cr.H,'i3riA..sfeta8pK" 


A Sasic raJi^fev a! 5- p.'ocessjno fee i.o! to exceed $4c,02 for first TO pages a5 fKWds. fbes, 

• ST S' per page for pages T'-'.D 

• S.7S per psg-efor pages C-T-OC' 

• SAC' per psge ter an--' wnriimno Papes 

• Plas aciiiai cost of or si'^ippit^ 

if the fppussted records o'e stored or a«y m^rofprm orothg'eiectfwcmediMm. sreTne---^ or i^tsessr^ fee vA'-kh most mrktdB the fee for prodding the first 
■ TC- pages of the copies and xvhtdnria.- not exceed 5^56 snci 
» ST.i-T PBrppa&tii*reB‘{er 

■ Actual cos! Or mailing, sitippirig, or ciher/.!se oeiN^hng jits provided crises 

ff 'ht mpussted records »re fwovirJed ort e digital w etscticnie meaiom and tiie requesting pady requests deli-.e«\ m. » digital weierJroriic medium, including 
electronic mail. 

• a iBTrie-.'al o' prccess'ivj fee vrfiinh may no! exceed $-?i.57. ar-d 

♦ the actual cosi of mailing, ^ipfxng. oi ’ottwrwse det!'~-ei''ng ttie f?ovid«J cofses. 

Title 22 Pad S Chapter 1C5 Role Tfi£.2 
Donors 

hio more than 525.1© for tiwj first iwiges:. then. 


» S 50 par i.>ag6 for »'.«ry erspy tltereafier 

• Irs aaoiliori. actua: cost of m’aiingor .shippiiw 

» Also, a leasonable fee cat to wteed St 5 55 for executisjg affida-rh, 

22 Texas Adminis-lrati'.-eC-ixie 5155.3 
DPCtws 

• Maxmiunc charge for x-rsjis arvd diagnostic imaging fiiiaiBS $? DO Mr cop“ 


Utah Code 

Title Chapter 5. Section 51C' Potiem access to necJicfl! rect'rcs 

• A health care provider who pn?.‘ides a copy of apatier^t's records to the patient or the patienrs pefSor.3J f6presentai\« may charge a reasonaWe fas to cover the (waith 
caie provider's costs 


Vsrmont 

15VSA §rui& Chjrgesfor access tomeeical fKOids 

• A custodian mav impose s charge that is no more than a fla $6.00 fee or mo more than IC.SG per page whicheter is gteeter for onoviding copies of an inidfviduars 
hfiahh care record 

• A CListwJian. mav charoe an moiviyual a fee reasonabf/ retated to Lhe aasxiaiec costs, for f»o-vKJfng copies of x-Qj-s. films. disks tapes, or olrw tiealth ca’e 

reccxc mformsficm maintaned tit other famials 


Virginia 

VA C-ocie 5 .J2. 1-127 i .i;3. h-eattr records pnyanv. 

If an indii-idiral m hu agent / sttome-.- regiiests a copy of his oriwr mojiaa! recoKis tire health eare enWy may tmpese .e reasrrnabie cost-hasKi fee vtfiich shtsil iiTclude the cost 
of supplies for and iaoor cf copying tiie requested rnformaice'- as wel- as p-ostage -A'here apfxicaye. 

NOTE .As to -v'.t-.at mir.- be regaroec as reescmable" in cc-n-necli-OR «‘h the abo-vs aaote. see. 
v'a C.orSft Sertic-n n i.r1-41.t i/l'D.l; 

i=3ami, 'i--vh?ige "a b®. n ajr V jhe ice •:•■' miantsmiAg, i^tneAng. f«'vie«RQ a>3 pi-epanrrg such copies Except for cos-es of X-.av ol'otograph.s howe-.-er siA-.h 
charges stiat not exceed 

. ?i-t. c=.rt-, par p,apfo' ’pt'ciT p-ngec 

• fv,-en:v-Ti-'6 cents 3 page ihersansr for top-’.es from paper <x other hard cofre generated from compuieriied or other e’ectrorxic stoiaje. -or otlier pi'iotogrspr-ic 
mecn.nnrcai ei"K:troric 10133100 cr chpmics) storage proc-ass 

■ one .'ioliar r>er cage for copies TOn mr.rorilm or other tnitregfSfwrc process plus all and sfkppKig costs arrd a search snci har.dlirofee r-ot to axceeci ter dollars 

« ii-' r.^icir j 'a.ii t> phv'icisn's. or other herJtr. care providers records « papers sh^ oe furrosliec- Aifliiii fifteen dsys of su-:h rsguea 
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Available at http://www.lainblawoffice.com/medical-records-copving-charges.html 
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